Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DNSX panics on CIDR mapping #500

Closed
ghost opened this issue Nov 15, 2023 · 1 comment · Fixed by #506
Closed

DNSX panics on CIDR mapping #500

ghost opened this issue Nov 15, 2023 · 1 comment · Fixed by #506
Assignees
Labels
Status: Completed Nothing further to be done with this issue. Awaiting to be closed. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Milestone

Comments

@ghost
Copy link

ghost commented Nov 15, 2023

dnsx version:

1.1.6

Current Behavior:

When scanning a list of domains for subdomains, using a wordlist I get the following panic error during ASN mapping.

Looks like the asnmap response returned when scanning may return invalid data which is not handled correctly. It looks to return a dataset with several missing fields.

This is on WIndows 11 64b, with go version go1.21.4 windows/amd64

panic: runtime error: index out of range [15] with length 0

goroutine 576 [running]:
github.com/projectdiscovery/mapcidr.ipNetToRange({{0x0, 0x0, 0x0}, {0xc004af0210, 0x10, 0x10}})
        %WIN_HOME%/go/pkg/mod/github.com/projectdiscovery/mapcidr@v1.1.15/ip.go:289 +0x4a5
github.com/projectdiscovery/mapcidr.partitionCIDR({{0xc004af01a0, 0x10, 0x10}, {0xc004af01b0, 0x10, 0x10}}, {{0x0, 0x0, 0x0}, {0xc004af0210, ...}})
        %WIN_HOME%/go/pkg/mod/github.com/projectdiscovery/mapcidr@v1.1.15/ip.go:622 +0x197
github.com/projectdiscovery/mapcidr.rangeToCIDRs({0x0, 0x0, 0x0}, {0x0, 0x0, 0x0})
        %WIN_HOME%/go/pkg/mod/github.com/projectdiscovery/mapcidr@v1.1.15/ip.go:599 +0x67d
github.com/projectdiscovery/mapcidr.GetCIDRFromIPRange({0x0, 0x0, 0x0}, {0x0, 0x0, 0x0})
        %WIN_HOME%/go/pkg/mod/github.com/projectdiscovery/mapcidr@v1.1.15/ip.go:1058 +0x130
github.com/projectdiscovery/asnmap/libs.GetCIDR({0xc0020bc870, 0x1, 0x1?})
        %WIN_HOME%/go/pkg/mod/github.com/projectdiscovery/asnmap@v1.0.6/libs/cidr.go:12 +0x1c5
github.com/projectdiscovery/dnsx/internal/runner.(*Runner).worker(0xc000132780)
        C:/git/dnsx/internal/runner/runner.go:701 +0x932
created by github.com/projectdiscovery/dnsx/internal/runner.(*Runner).startWorkers in goroutine 1
        C:/git/dnsx/internal/runner/runner.go:614 +0xb6

Expected Behavior:

Previous versions has completed the same search correctly.

Steps To Reproduce:

  1. Download the latest repo
  2. go mod download
  3. go build .\cmd\dnsx
  4. The command run for enumeration is .\dnsx\dnsx.exe -a -cname -mx -txt -asn -w .\datasets\wordlist-fqdn-sorted.txt -retry 1 -r 1.0.0.1,8.8.4.4,149.112.112.112 -json -t 1500 -o .\dnsx.json -d .\domains.txt

After adding an error print message on line 700 dnsx/internal/runner/runner.go I got the following message, which shows that the start and end field of the asnmap.Response are missing.
gologger.Error().Msgf("%s - %d results: %s", domain, len(results), results)

[ERR] interactintegrasjoner.DOMAIN- 1 results: [%!s(*asnmap.Response=&{ HOST_IPv4 ASN NUMBER COUNTRY_CODE ASNNAME Peering: ASN_EMAIL})]

Running DNSX looking just for this FQDN, ``, it runs okay and returns a better ASNmap.
.\dnsx.exe -a -cname -mx -txt -asn -w interactintegrasjoner -retry 1 -r 1.0.0.1,8.8.4.4,149.112.112.112 -json -t 1500 -d DOMAIN

[ERR] interactintegrasjoner.DOMAIN - 1 results: [%!s(*asnmap.Response=&{IP_NET_START IP_NET_END ASN NUMBER COUNTRY_CODE ASNNAME Peering: ASN_EMAIL})]

@ghost ghost added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Nov 15, 2023
@ghost
Copy link
Author

ghost commented Nov 15, 2023

After more testing, it appears this is due to scanning beyond capability probably. As i ran it with 1500 threads, scaling down to 500 seems to work fine.
So maybe adding a better error handling for asnmap lookup would suffice.

@dogancanbakir dogancanbakir self-assigned this Nov 20, 2023
@ehsandeep ehsandeep linked a pull request Nov 23, 2023 that will close this issue
@ehsandeep ehsandeep added the Status: Completed Nothing further to be done with this issue. Awaiting to be closed. label Mar 1, 2024
@ehsandeep ehsandeep added this to the dnsx v1.2.0 milestone Mar 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Completed Nothing further to be done with this issue. Awaiting to be closed. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants