mdaxfr/extras/daxfr

#!/bin/sh
# Domain AXFR - developed by acidvegas (https://git.acid.vegas/mdaxfr)
# This one will take a domain as an argument and attempt to perform an AXFR against all of the nameservers for that domain.
# You can also pass an AXFR output file as an argument to attempt AXFR against all of the unique domains found in the file.

# Colors
BLUE="\033[1;34m"
CYAN="\033[1;36m"
GREEN="\033[1;32m"
GREY="\033[1;90m"
PURPLE='\033[0;35m'
RED="\033[1;31m"
YELLOW="\033[1;33m"
RESET="\033[0m"

# Globals
output_dir="daxfrout"

perform_axfr() {
    domain=$1
    ns=$2
    ip=$3

    echo "${YELLOW}Attempting AXFR for ${CYAN}${domain}${YELLOW} from ${PURPLE}${ns} ${GREY}(${ip})${RESET}"

    axfr_output=$(dig +retry=3 +time=10 @$ip AXFR $domain)
    axfr_status=$?

    if [ $axfr_status -eq 0 ] && echo "$axfr_output" | grep -q "XFR size: "; then
        echo "$axfr_output" > "${output+dir}/axfr-${domain}_${ns}_${ip}.txt"
        size=$(echo "$axfr_output" | awk '/XFR size:/ {print $4}')
        echo "${GREEN}Successful AXFR for ${CYAN}${domain}${GREEN} from ${PURPLE}${ns} ${GREY}(${ip}) ${BLUE}[${size} records]${RESET}"
    else
        echo "${RED}    Failed AXFR for ${CYAN}${domain}${RED} from ${PURPLE}${ns} ${GREY}(${ip})${RESET}"
    fi
}

process_domain() {
    domain=$1
    nameservers=$(dig +short +retry=3 +time=10 $domain NS)

    [ -z "$nameservers" ] && echo "${GREY}No nameservers found for ${CYAN}${domain}{$RESET}" && return

    for ns in $nameservers; do
        ns=$(echo "$ns" | sed 's/\.$//')
        ns_ip=$(host $ns | awk '/has (IPv6 )?address/ { print $NF }')

        [ -z "$ns_ip" ] && echo "${GREY}No IP addresses found for nameserver ${PURPLE}${ns}${GREY} under ${CYAN}${domain}{RESET}" && continue

        for ip in $ns_ip; do
            perform_axfr "$domain" "$ns" "$ip"
        done
    done
}

[ $# -eq 0 ] && echo "Usage: $0 <domain> or <path_to_axfr_output>" && exit 1

mkdir -p $output_dir

if [ -f "$1" ]; then
    root=$(grep -m1 '^; <<>> DiG' $1 | awk '{print $(NF-1)}') # Get the root domain from the dig output
    domains=$(grep -a $'\t'IN$'\t'NS$'\t' "$1" | awk '{print $1}' | sort -u | sed 's/\.$//' | grep -v "^$root\.$") # Get the unique domains from the dig output (excluding the root domain)
    
    for domain in $domains; do
        process_domain $domain
    done
else
    process_domain $1
fi