Owl_DNS Engine | Error Get findings

[ST2Labs]

Hi,

I'm trying to set OWL_DNS engine, but:

• Policy Example ?

My own test with te following Policy fails:

{
  "do_advanced_whois":{
    "required":true,
    "value":"boolean"
  },
  "do_dns_resolve":{
    "required":false,
    "value":"boolean"
  },
  "do_whois":{
    "required":true,
    "value":"boolean"
  },
  "do_reverse_dns":{
    "required":false,
    "value":"boolean"
  },
  "do_subdomains_resolve":{
    "required":false,
    "value":"boolean"
  }
}

Thanks in advance

[MaKyOtOx]

Hi
Here is an example of testing script (direct call the Engine API):

import json, requests, time
print("TEST CASE: test_startscan_owl_dns")

post_data = {
    "assets": [
        {
            "value":'patrowl.io',
            "datatype": "domain"
            }, {
            "value":212.32.66.58',
            "datatype": "ip"
            },
        ],
    "options": {
        "max_timeout": 3600,
        "do_subdomain_enum": False,
        "do_whois": True,
        "do_advanced_whois": False,
        "do_reverse_dns": False,
        "do_dns_resolve": False,
        "do_subdomains_resolve": False,
        "do_subdomain_bruteforce": False
    },
    "scan_id": "34"
}

r = requests.post(url='http://127.0.0.1:5006/engines/owl_dns/startscan',
           data=json.dumps(post_data),
           headers = {'Content-type': 'application/json', 'Accept': 'application/json'})

print(r.json())

[MaKyOtOx]

In PatrowlManager, the policy will be (careful with the CaPiTaLiSaTiOn):

{
        "max_timeout": 3600,
        "do_subdomain_enum": false,
        "do_whois": true,
        "do_advanced_whois": false,
        "do_reverse_dns": false,
        "do_dns_resolve": false,
        "do_subdomains_resolve": false,
        "do_subdomain_bruteforce": false
    }

We will soon release policies for each engine.

[ST2Labs]

Hi,

I'm using your example policy (whois), but getting the following error:

I havent any "results file" & log in docker logs:

Show KeyError un parse results in "owl_dns" ...

Thanks in advance

[MaKyOtOx]

I've reproduced the issue. This error raise when you try to get WHOIS data from a subdomain name.
Nevertheless, there is no WHOIS for sub-domains. WHOIS is available for registered domains only.
Additional checks will catch the exception in the next release.

An interesting feature could be getting Whois data from extraction of the valid domain name