Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add payload in dns protocol #3632

Merged
merged 8 commits into from
May 10, 2023
Merged

Add payload in dns protocol #3632

merged 8 commits into from
May 10, 2023

Conversation

ShubhamRasal
Copy link
Contributor

@ShubhamRasal ShubhamRasal commented May 2, 2023

Template
id: dns-attack

info:
  name: basic dns template
  author: pdteam
  severity: info


dns:
  - name: "{{subdomain_wordlist}}.{{FQDN}}"
    type: A

    attack: batteringram
    payloads:
      subdomain_wordlist: 
      - one
      - docs
      - drive
    
    matchers:
      - type: word
        words:
          - "IN\tA"

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tA\t(.+)"

command

./nuclei -u https://google.com -t templates/dns-payload.yaml 

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.3-dev

		projectdiscovery.io

[INF] Current nuclei version: v2.9.3-dev (development)
[INF] Current nuclei-templates version: 9.4.3 (latest)
[INF] New templates added in latest release: 55
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[dns-attack] [dns] [info] google.com. [172.217.160.174]
[dns-attack] [dns] [info] google.com. [142.250.182.206]
[dns-attack] [dns] [info] google.com. [142.250.199.174]

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

@ShubhamRasal ShubhamRasal self-assigned this May 2, 2023
@ShubhamRasal ShubhamRasal linked an issue May 2, 2023 that may be closed by this pull request
Copy link
Member

@ehsandeep ehsandeep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • matched at to include complete dns name in json/cli output
  • removed trailing dot in dns name output

Copy link
Member

@ehsandeep ehsandeep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Minor issue with stats calculation with payloads.
  • debug / verbose mode should also reflect queried dns name instead of input.
echo google.com | ./nuclei -t test.yaml -stats -v

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.3-dev

		projectdiscovery.io

[INF] Current nuclei version: v2.9.3-dev (development)
[INF] Current nuclei-templates version: v9.4.3 (latest)
[INF] New templates added in latest release: 55
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[VER] [dns-attack] Sent DNS request to google.com.
[VER] [dns-attack] Sent DNS request to google.com.
[VER] [dns-attack] Sent DNS request to google.com.
[VER] [dns-attack] Sent DNS request to google.com.
[VER] [dns-attack] Sent DNS request to google.com.
[0:00:05] | Templates: 1 | Hosts: 1 | RPS: 1 | Matched: 0 | Errors: 3 | Requests: 8/1 (800%)

Base automatically changed from dev to main May 3, 2023 20:26
@ehsandeep ehsandeep changed the base branch from main to dev May 3, 2023 20:27
- Update verbose output to print question
- Update dns requests Requests function to consider payload data
@ShubhamRasal
Copy link
Contributor Author

./nuclei -u https://google.com -t templates/dns-payload.yaml -stats  -v

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.3-dev

		projectdiscovery.io

[INF] Current nuclei version: v2.9.3-dev (outdated)
[INF] Current nuclei-templates version: 9.4.3 (latest)
[INF] New templates added in latest release: 55
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[VER] [dns-attack] Sent DNS request to one.google.com
[dns-attack] [dns] [info] one.google.com [142.250.183.14]
[VER] [dns-attack] Sent DNS request to docs.google.com
[dns-attack] [dns] [info] docs.google.com [142.251.42.14]
[VER] [dns-attack] Sent DNS request to drive.google.com
[dns-attack] [dns] [info] drive.google.com [142.250.192.110]
[0:00:00] | Templates: 1 | Hosts: 1 | RPS: 51 | Matched: 3 | Errors: 0 | Requests: 3/3 (100%)

Copy link
Member

@tarunKoyalwar tarunKoyalwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

$  ./nuclei -u google.com -t ~/test-templates/dnspayload.yaml       

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.3-dev

		projectdiscovery.io

[INF] Current nuclei version: v2.9.3-dev (outdated)
[INF] Current nuclei-templates version: v9.4.3 (latest)
[INF] New templates added in latest release: 18
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[dns-attack] [dns] [info] one.google.com [142.251.42.110]
[dns-attack] [dns] [info] docs.google.com [142.250.183.174]
[dns-attack] [dns] [info] drive.google.com [142.250.183.206]

@ehsandeep ehsandeep merged commit 9c2fa8f into dev May 10, 2023
11 checks passed
@ehsandeep ehsandeep deleted the issue-3412-payload-dns branch May 10, 2023 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

payloads support in dns protocol
3 participants