bass for the finished tool :)This repo is more of me sharing an idea with everyone. Head over to
A tool that turns the authoritative nameservers of DNS providers to resolvers and resolves the target domain list. As of now the tool only resolves the A record for the list of domains.
Why Authoritative Nameservers?
- They are always reliable and always up!
- Sometimes the public dns resolvers would sprout up junk records. Authoritative nameservers would never do that.
- Every DNS server is rate-limited. They have to be. Hence we need numbers at our side. This tool tries to do just that by poking at the DNS providers infrastructure and asking for a whole lot of active authoritative DNS servers to resolve one of their clients( our target ).
This is more of a Proof Of Concept turned into a tool.
Let me know what your tests show and what issues you run into ? Is this a vialble approach ? Can something more be done ?
The idea behind this tool is a product of observing how an authoritative nameserver of
TARGET1 would also resolve
TARGET2 provided both belonged to the same DNS Provider. So using this we could for a
TARGET collect a huge bunch of authoritative nameservers and use them as resolvers instead of using the public dns resolvers.
$ host -t ns bugcrowd.com bugcrowd.com name server edna.ns.cloudflare.com. bugcrowd.com name server lee.ns.cloudflare.com.
$ host -t ns upserve.com upserve.com name server ulla.ns.cloudflare.com. upserve.com name server jay.ns.cloudflare.com.
bugcrowd.comusing upserve's nameserver
$ nslookup bugcrowd.com jay.ns.cloudflare.com Server: jay.ns.cloudflare.com Address: 22.214.171.124#53 Name: bugcrowd.com Address: 126.96.36.199 Name: bugcrowd.com Address: 188.8.131.52 Name: bugcrowd.com Address: 2606:4700:10::6814:5ef Name: bugcrowd.com Address: 2606:4700:10::6814:4ef
docs.bugcrowd.comusing upserve's nameserver
$ nslookup docs.bugcrowd.com jay.ns.cloudflare.com Server: jay.ns.cloudflare.com Address: 184.108.40.206#53 Name: docs.bugcrowd.com Address: 220.127.116.11 Name: docs.bugcrowd.com Address: 18.104.22.168 Name: docs.bugcrowd.com Address: 2606:4700:10::6814:5ef Name: docs.bugcrowd.com Address: 2606:4700:10::6814:4ef
- Repeating the same for
upserve.comusing bugcrowd's nameserver
$ nslookup upserve.com edna.ns.cloudflare.com Server: edna.ns.cloudflare.com Address: 22.214.171.124#53 Name: upserve.com Address: 126.96.36.199
As seen above how the authoritative nameserver's aren't tied down to their specific domain names, we could leverage the way these DNS providers are configured. We could probe into the IP range of the respective DNS Providers > grab all the active DNS servers in their range > use them as resolvers against our target list. All these servers would answer authoritatively due to their configuration as observed.
$ sudo apt-get install ipcalc
$ cd massNS $ chmod +x massns.sh $ ./massns.sh target.com /path/to/target/domains
- Generic output
- Only IP addresses
- Stats at the end!
awsdnsseems to not allow this.
- Custom nameserver like the one's employed by twitter (twtrdns.net) ,facebook etc. They might be hosted on services like amazon which would straight up
DNS Providers :
DNS providers that allow this are :
dnsimpleand a lot more to be found.
As of now the above DNS providers are found to be allowing this. Make sure your target employs atleast one of these. To find that out ,
host -t ns target.com | grep 'ns\.cloudflare\|dynect\dnsimple\|ultradns'
Against Paypal the tool could gather
698 authoritative nameservers turned resolvers, a combination of dns servers from both
ultradns a spaypal employs them.
Kudos to Patrik Hudak for some good suggestions and help.
P.S : This is purely experimental. Please do share what you think of this approach. Thanks!