Add DNS Trace for DNS Templates

[m0chan]

Is your feature request related to a problem? Please describe.

Currently for DNS templates we can only 'match' on terms when a domain is not in an error state, for example if it's in SERVFAIL we cannot see the authoritative name-servers it fails on.

Describe the solution you'd like

-trace flag - This would allow nuclei to walk the whole DNS tree and match on any user supplied term it encounters.

Hmu on twitter if you need me to explain in greater depth. m0chan98

[indianajson]

I would like to second this request. There is a group of vulnerabilities relating to DNS that cannot be identified with Nuclei directly because of this limitation. While getting a SERVFAIL back from Nuclei is nice, that leaves a lot of manual work for researchers investigating DNS misconfigurations. Adding +trace would allow that work to be automated into a nice workflow + template.

[Mzack9999]

This should be covered in #641 (still in development), the internal scripting engine has access to dnsx methods (including trace)

[ehsandeep]

@indianajson @m0chan this is now supported at the template level in the dev branch, trace: true will perform DNS tracing for the requested domain similar to dig +trace

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    trace: true
    trace-max-recursion: 10