mdaxfr/mdaxfr

73 lines
2.4 KiB
Bash
Executable File

#!/bin/sh
# Mass DNS AXFR (POSIX version) - developed by acidvegas (https://git.acid.vegas/mdaxfr)
OUTPUT_DIR="axfrout"
mkdir -p "$OUTPUT_DIR"
mkdir -p "$OUTPUT_DIR/root"
mkdir -p "$OUTPUT_DIR/psl"
resolve_nameserver() {
dig +short AAAA $1 +short -t A $1 2>/dev/null
}
attempt_axfr() {
tld=$1
nameserver=$2
filename="$3"
temp_file="${filename}.temp"
nameserver_ips=$(resolve_nameserver "$nameserver")
if [ -z "$nameserver_ips" ]; then
echo -e "\e[31m[FAIL]\e[0m AXFR for \e[36m$tld\e[0m on \e[33m$nameserver\e[0m \e[90m(failed to resolve nameserver)\e[0m"
return
fi
for nameserver_ip in $nameserver_ips; do
dig AXFR "$tld" "@$nameserver_ip" > "$temp_file"
if ! grep -q 'IN.*NS' "$temp_file"; then
echo -e "[\e[31mFAIL\e[0m] AXFR for \e[36m$tld\e[0m on \e[33m$nameserver\e[0m \e[90m($nameserver_ip)\e[0m"
rm -f "$temp_file"
else
mv "$temp_file" "$filename"
echo -e "[\e[32mSUCCESS\e[0m] AXFR for \e[36m$tld\e[0m on \e[33m$nameserver\e[0m \e[90m($nameserver_ip)\e[0m"
return
fi
done
}
echo "[\e[31mWARNING\e[0m] Most nameservers will block AXFR requests \e[90m(It is normal for most of these to fail)\e[0m"
sleep 3
# For root IP space zones
for i in $(seq 0 255); do
dig +nocmd +noall +answer +multiline $i.in-addr.arpa NS >> $OUTPUT_DIR/root/in-addr.arpa.txt
done
# For root nameservers
for root in $(dig +short . NS | sed 's/\.$//'); do
attempt_axfr "." "$root" "$OUTPUT_DIR/root/$root.txt"
done
# Parse the tld list from a root nameserver
rndroot=$(find $OUTPUT_DIR/root/*.root-servers.net.txt -type f | shuf -n 1)
if [ -z $rndroot ]; then
echo "Failed to AXFR a root nameserver (using IANA list instead)"
tlds=$(curl -s 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt' | tail -n +2 | tr '[:upper:]' '[:lower:]')
else
tlds=$(cat $rndroot | grep -E 'IN\s+NS' | awk '{print $1}' | sed 's/\.$//' | sort -u)
fi
# For TLD nameservers
for tld in $tlds; do
for ns in $(dig +short "$tld" NS | sed 's/\.$//'); do
attempt_axfr "$tld" "$ns" "$OUTPUT_DIR/$tld.txt"
done
done
# For Public Suffix List TLD nameservers
for tld in $(curl -s https://publicsuffix.org/list/public_suffix_list.dat | grep -vE '^(//|.*[*!])' | grep '\.' | awk '{print $1}'); do
for ns in $(dig +short "$tld" NS | sed 's/\.$//'); do
attempt_axfr "$tld" "$ns" "$OUTPUT_DIR/psl/$tld.txt"
done
done