trickest / resolvers Goto Github PK

I am using this wordlist (9m) https://wordlists-cdn.assetnote.io/data/manual/best-dns-wordlist.txt with puredns (Horizontal Scaling - Many to One). on 100 instances. The wordlist is splitted 9m/100 instance = 95k for each instance this 95k takes 20 sec with puredns on my digitalocean VPS but when I run it using axiom the execution time is +10m I expected the execution time to be -1m since axiom executes all puredns instances in same time is this intended?

[{
    "command":"/home/op/go/bin/puredns bruteforce input  --resolvers /home/op/resolvers.txt | tee output",
    "ext":"txt",
}]

These are the results I'm getting when resolving the A records of the Alexa top 5k domains using the resolvers from this repository:

root@vps:~/dns-test# cat output-base.txt | sort -n -r
   4834 status: NOERROR
    733 status: REFUSED
     68 status: SERVFAIL
     24 status: NXDOMAIN

Further filtering on resolvers.txt using custom dnsvalidator options results in more stable output:

root@vps:~/dns-test# cat output-new.txt | sort -n -r
   4910 status: NOERROR
     89 status: SERVFAIL
     22 status: NXDOMAIN
      2 status: REFUSED

Note that these do include retries on timeouts, which explains why the total responses might exceed the 5k number.

I've done some investigating and it seems like some DNS servers will refuse to serve records for certain domains. For example:

• 162.159.11.139 will refuse example.com, youtube.com, facebook.com, but not slack.com or lesser-known domains.
• 162.159.34.74 will refuse example.com, youtube.com, facebook.com, but not slack.com or lesser-known domains.

dnsvalidator relies on bet365.com, which works, but provides little guarantee that it will work on random domains as well. I think it's best to not make use of the default configuration to improve the quality of the resulting resolver list. Additionally, dnsvalidator has some minor issues that may affect results: vortexau/dnsvalidator#40

Hi !
The bot might be broken. No update since 8 days from now.

Have a great day :)

Just to notify you that the resolvers are not updated since 12 of august

The bot might be broken, no update for 3 days

Thank you for your repos !

As per title.

There's a couple of trusted resolvers which are always returning invalid DNS records. There should probably be checks to ensure misbehaving resolvers are removed from the trusted resolvers file if they can no longer be trusted.

dig @76.76.19.19 thisdoesnotexist2023.trickest.com

; <<>> DiG 9.10.6 <<>> @76.76.19.19 thisdoesnotexist2023.trickest.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7023
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;thisdoesnotexist2023.trickest.com. IN	A

;; ANSWER SECTION:
thISDoesnotexist2023.trickest.com. 300 IN A	54.144.128.85

;; Query time: 245 msec
;; SERVER: 76.76.19.19#53(76.76.19.19)
;; WHEN: Fri Oct 20 01:12:08 +04 2023
;; MSG SIZE  rcvd: 99

dig @76.223.122.150 thisdoesnotexist2023.trickest.com

; <<>> DiG 9.10.6 <<>> @76.223.122.150 thisdoesnotexist2023.trickest.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8931
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;thisdoesnotexist2023.trickest.com. IN	A

;; ANSWER SECTION:
thISDoesnotexist2023.trickest.com. 300 IN A	54.144.128.85

;; Query time: 2075 msec
;; SERVER: 76.223.122.150#53(76.223.122.150)
;; WHEN: Fri Oct 20 01:13:18 +04 2023
;; MSG SIZE  rcvd: 99

To get the frequency data, the workflow collects the results of all previous runs. This currently leads to the results of all previous workflow runs being merged with the current run's results leading to some false positives.

Only the results of the latest run should be pushed to the final output file.