dns_enum_tool.py

#!/usr/bin/env python3
"""
DNS Records Enumeration Tool
A comprehensive tool for DNS reconnaissance and enumeration
Author: Sergios9494
Version: 1.0
"""

import dns.resolver
import dns.zone
import dns.query
import socket
import argparse
import sys
import json
import csv
import threading
import time
from datetime import datetime
from concurrent.futures import ThreadPoolExecutor, as_completed
import requests
from urllib.parse import urlparse

class DNSEnumTool:
    def __init__(self, domain, verbose=False, threads=10):
        self.domain = domain
        self.verbose = verbose
        self.threads = threads
        self.results = {
            'domain': domain,
            'timestamp': datetime.now().isoformat(),
            'records': {},
            'subdomains': [],
            'errors': []
        }
        
        # Common DNS record types to check
        self.record_types = [
            'A', 'AAAA', 'CNAME', 'MX', 'NS', 'TXT', 'SOA', 
            'PTR', 'SRV', 'CAA', 'DNSKEY', 'DS', 'NSEC', 'NSEC3'
        ]
        
        # Common subdomain wordlist
        self.subdomain_wordlist = [
            'www', 'mail', 'ftp', 'localhost', 'webmail', 'smtp', 'pop', 'ns1', 'webdisk', 'ns2',
            'cpanel', 'whm', 'autodiscover', 'autoconfig', 'm', 'imap', 'test', 'ns', 'blog',
            'pop3', 'dev', 'www2', 'admin', 'forum', 'news', 'vpn', 'ns3', 'mail2', 'new',
            'mysql', 'old', 'www1', 'www3', 'www4', 'www5', 'www6', 'www7', 'www8', 'www9',
            'api', 'api1', 'api2', 'api3', 'api4', 'api5', 'api6', 'api7', 'api8', 'api9',
            'app', 'app1', 'app2', 'app3', 'app4', 'app5', 'app6', 'app7', 'app8', 'app9',
            'beta', 'beta1', 'beta2', 'beta3', 'beta4', 'beta5', 'beta6', 'beta7', 'beta8', 'beta9',
            'staging', 'staging1', 'staging2', 'staging3', 'staging4', 'staging5', 'staging6', 'staging7', 'staging8', 'staging9',
            'dev1', 'dev2', 'dev3', 'dev4', 'dev5', 'dev6', 'dev7', 'dev8', 'dev9',
            'test1', 'test2', 'test3', 'test4', 'test5', 'test6', 'test7', 'test8', 'test9',
            'demo', 'demo1', 'demo2', 'demo3', 'demo4', 'demo5', 'demo6', 'demo7', 'demo8', 'demo9',
            'stage', 'stage1', 'stage2', 'stage3', 'stage4', 'stage5', 'stage6', 'stage7', 'stage8', 'stage9',
            'cdn', 'cdn1', 'cdn2', 'cdn3', 'cdn4', 'cdn5', 'cdn6', 'cdn7', 'cdn8', 'cdn9',
            'static', 'static1', 'static2', 'static3', 'static4', 'static5', 'static6', 'static7', 'static8', 'static9',
            'media', 'media1', 'media2', 'media3', 'media4', 'media5', 'media6', 'media7', 'media8', 'media9',
            'img', 'img1', 'img2', 'img3', 'img4', 'img5', 'img6', 'img7', 'img8', 'img9',
            'images', 'images1', 'images2', 'images3', 'images4', 'images5', 'images6', 'images7', 'images8', 'images9',
            'js', 'js1', 'js2', 'js3', 'js4', 'js5', 'js6', 'js7', 'js8', 'js9',
            'css', 'css1', 'css2', 'css3', 'css4', 'css5', 'css6', 'css7', 'css8', 'css9',
            'assets', 'assets1', 'assets2', 'assets3', 'assets4', 'assets5', 'assets6', 'assets7', 'assets8', 'assets9',
            'download', 'downloads', 'upload', 'uploads', 'file', 'files', 'doc', 'docs', 'document', 'documents',
            'support', 'help', 'faq', 'contact', 'about', 'info', 'news', 'blog', 'forum', 'community',
            'shop', 'store', 'buy', 'cart', 'checkout', 'payment', 'pay', 'billing', 'account', 'accounts',
            'user', 'users', 'member', 'members', 'profile', 'profiles', 'login', 'signin', 'signup', 'register',
            'dashboard', 'panel', 'admin', 'administrator', 'root', 'guest', 'public', 'private', 'secure', 'security',
            'ssl', 'tls', 'cert', 'certificate', 'ca', 'pki', 'key', 'keys', 'token', 'tokens',
            'auth', 'authentication', 'authorization', 'oauth', 'sso', 'ldap', 'ad', 'active-directory',
            'db', 'database', 'sql', 'mysql', 'postgres', 'mongo', 'redis', 'cache', 'caching',
            'backup', 'backups', 'restore', 'recovery', 'archive', 'archives', 'log', 'logs', 'monitor', 'monitoring',
            'stats', 'statistics', 'analytics', 'metrics', 'report', 'reports', 'export', 'import',
            'sync', 'synchronization', 'replication', 'cluster', 'load-balancer', 'proxy', 'gateway',
            'firewall', 'waf', 'ids', 'ips', 'siem', 'soc', 'threat', 'vulnerability', 'scan', 'scanner',
            'pentest', 'penetration', 'security-test', 'vuln', 'exploit', 'payload', 'malware', 'virus',
            'phishing', 'spam', 'bot', 'botnet', 'trojan', 'backdoor', 'rootkit', 'keylogger', 'spyware',
            'adware', 'ransomware', 'crypto', 'bitcoin', 'ethereum', 'blockchain', 'mining', 'wallet',
            'exchange', 'trading', 'market', 'finance', 'banking', 'payment', 'credit', 'debit', 'card',
            'insurance', 'healthcare', 'medical', 'hospital', 'clinic', 'pharmacy', 'doctor', 'patient',
            'education', 'school', 'university', 'college', 'student', 'teacher', 'professor', 'course',
            'government', 'gov', 'military', 'defense', 'intelligence', 'cia', 'fbi', 'nsa', 'dhs',
            'law', 'legal', 'court', 'judge', 'lawyer', 'attorney', 'justice', 'police', 'sheriff',
            'transportation', 'travel', 'tourism', 'hotel', 'restaurant', 'food', 'delivery', 'taxi',
            'uber', 'lyft', 'airline', 'airport', 'train', 'bus', 'subway', 'metro', 'bike', 'scooter',
            'real-estate', 'property', 'house', 'apartment', 'rent', 'buy', 'sell', 'mortgage', 'loan',
            'entertainment', 'movie', 'music', 'game', 'gaming', 'sport', 'sports', 'fitness', 'gym',
            'news', 'newspaper', 'magazine', 'radio', 'tv', 'television', 'streaming', 'video', 'audio',
            'social', 'facebook', 'twitter', 'instagram', 'linkedin', 'youtube', 'tiktok', 'snapchat',
            'messaging', 'chat', 'voice', 'video-call', 'conference', 'meeting', 'webinar', 'training',
            'job', 'jobs', 'career', 'careers', 'employment', 'hiring', 'recruit', 'recruitment', 'hr',
            'human-resources', 'payroll', 'benefits', 'vacation', 'sick', 'leave', 'time-off', 'holiday',
            'calendar', 'schedule', 'appointment', 'booking', 'reservation', 'ticket', 'tickets', 'event',
            'events', 'conference', 'conferences', 'seminar', 'seminars', 'workshop', 'workshops', 'training',
            'course', 'courses', 'lesson', 'lessons', 'tutorial', 'tutorials', 'guide', 'guides', 'manual',
            'documentation', 'api', 'sdk', 'library', 'libraries', 'framework', 'frameworks', 'tool', 'tools',
            'software', 'application', 'applications', 'app', 'apps', 'program', 'programs', 'script', 'scripts',
            'code', 'source', 'repository', 'repo', 'git', 'github', 'gitlab', 'bitbucket', 'svn', 'mercurial',
            'version-control', 'ci', 'cd', 'deployment', 'deploy', 'production', 'staging', 'development',
            'testing', 'qa', 'quality-assurance', 'bug', 'bugs', 'issue', 'issues', 'feature', 'features',
            'enhancement', 'enhancements', 'improvement', 'improvements', 'optimization', 'optimizations',
            'performance', 'speed', 'latency', 'throughput', 'bandwidth', 'memory', 'cpu', 'disk', 'storage',
            'cloud', 'aws', 'azure', 'gcp', 'google-cloud', 'digital-ocean', 'linode', 'vultr', 'heroku',
            'docker', 'kubernetes', 'k8s', 'container', 'containers', 'microservice', 'microservices',
            'serverless', 'lambda', 'function', 'functions', 'edge', 'cdn', 'content-delivery-network',
            'dns', 'domain', 'domains', 'subdomain', 'subdomains', 'wildcard', 'ssl-certificate', 'tls',
            'https', 'http', 'ftp', 'sftp', 'ssh', 'telnet', 'rdp', 'vnc', 'smb', 'smb1', 'smb2', 'smb3',
            'ldap', 'ldaps', 'kerberos', 'ntlm', 'oauth', 'oauth2', 'jwt', 'token', 'tokens', 'session',
            'cookie', 'cookies', 'cache', 'caching', 'redis', 'memcached', 'elasticsearch', 'solr',
            'mongodb', 'mysql', 'postgresql', 'oracle', 'sqlite', 'mssql', 'sql-server', 'database',
            'databases', 'table', 'tables', 'index', 'indexes', 'query', 'queries', 'sql', 'nosql',
            'big-data', 'hadoop', 'spark', 'kafka', 'rabbitmq', 'activemq', 'zeromq', 'nats', 'grpc',
            'rest', 'restful', 'soap', 'xml', 'json', 'yaml', 'toml', 'ini', 'conf', 'config', 'configuration',
            'env', 'environment', 'variables', 'secrets', 'credentials', 'password', 'passwords', 'hash',
            'hashes', 'encryption', 'decryption', 'cipher', 'ciphertext', 'plaintext', 'key', 'keys',
            'public-key', 'private-key', 'certificate', 'certificates', 'ca', 'certificate-authority',
            'pki', 'public-key-infrastructure', 'x509', 'pem', 'der', 'p12', 'pfx', 'jks', 'keystore',
            'truststore', 'ssl', 'tls', 'dtls', 'quic', 'http2', 'http3', 'websocket', 'socket', 'sockets',
            'tcp', 'udp', 'icmp', 'arp', 'rarp', 'ip', 'ipv4', 'ipv6', 'mac', 'ethernet', 'wifi', 'bluetooth',
            'zigbee', 'z-wave', 'lora', 'nb-iot', 'cat-m1', '5g', '4g', '3g', '2g', 'gsm', 'cdma', 'lte',
            'wimax', 'satellite', 'fiber', 'copper', 'dsl', 'cable', 'dial-up', 'isdn', 'frame-relay',
            'atm', 'mpls', 'vpn', 'ipsec', 'gre', 'l2tp', 'pptp', 'sstp', 'openvpn', 'wireguard',
            'tor', 'i2p', 'freenet', 'gnunet', 'retroshare', 'tox', 'signal', 'telegram', 'whatsapp',
            'skype', 'zoom', 'teams', 'slack', 'discord', 'irc', 'xmpp', 'jabber', 'matrix', 'element',
            'mattermost', 'rocket-chat', 'zulip', 'mumble', 'teamspeak', 'ventrilo', 'curse', 'discord',
            'steam', 'origin', 'epic', 'uplay', 'battle-net', 'gog', 'itch', 'humble', 'green-man-gaming',
            'fanatical', 'indiegala', 'bundle-stars', 'chrono', 'gamesplanet', 'wingamestore', 'gamersgate',
            'direct2drive', 'impulse', 'stardock', 'desura', 'gamefly', 'onlive', 'gaikai', 'playstation-now',
            'xbox-game-pass', 'stadia', 'luna', 'geforce-now', 'shadow', 'parsec', 'moonlight', 'steam-link',
            'nvidia-shield', 'apple-tv', 'roku', 'fire-tv', 'chromecast', 'miracast', 'airplay', 'dlna',
            'upnp', 'bonjour', 'avahi', 'zeroconf', 'mdns', 'llmnr', 'netbios', 'wins', 'dns', 'dhcp',
            'ntp', 'snmp', 'syslog', 'rsyslog', 'journald', 'logrotate', 'logwatch', 'logcheck', 'fail2ban',
            'denyhosts', 'sshguard', 'csf', 'lfd', 'modsecurity', 'mod-evasive', 'mod-dos', 'mod-security',
            'apache', 'nginx', 'lighttpd', 'cherokee', 'h2o', 'caddy', 'traefik', 'envoy', 'haproxy',
            'varnish', 'squid', 'polipo', 'privoxy', 'tor', 'i2p', 'freenet', 'gnunet', 'retroshare',
            'tox', 'signal', 'telegram', 'whatsapp', 'skype', 'zoom', 'teams', 'slack', 'discord',
            'irc', 'xmpp', 'jabber', 'matrix', 'element', 'mattermost', 'rocket-chat', 'zulip',
            'mumble', 'teamspeak', 'ventrilo', 'curse', 'discord', 'steam', 'origin', 'epic', 'uplay',
            'battle-net', 'gog', 'itch', 'humble', 'green-man-gaming', 'fanatical', 'indiegala',
            'bundle-stars', 'chrono', 'gamesplanet', 'wingamestore', 'gamersgate', 'direct2drive',
            'impulse', 'stardock', 'desura', 'gamefly', 'onlive', 'gaikai', 'playstation-now',
            'xbox-game-pass', 'stadia', 'luna', 'geforce-now', 'shadow', 'parsec', 'moonlight',
            'steam-link', 'nvidia-shield', 'apple-tv', 'roku', 'fire-tv', 'chromecast', 'miracast',
            'airplay', 'dlna', 'upnp', 'bonjour', 'avahi', 'zeroconf', 'mdns', 'llmnr', 'netbios',
            'wins', 'dns', 'dhcp', 'ntp', 'snmp', 'syslog', 'rsyslog', 'journald', 'logrotate',
            'logwatch', 'logcheck', 'fail2ban', 'denyhosts', 'sshguard', 'csf', 'lfd', 'modsecurity',
            'mod-evasive', 'mod-dos', 'mod-security', 'apache', 'nginx', 'lighttpd', 'cherokee',
            'h2o', 'caddy', 'traefik', 'envoy', 'haproxy', 'varnish', 'squid', 'polipo', 'privoxy'
        ]

    def log(self, message, level="INFO"):
        """Log messages with timestamp"""
        timestamp = datetime.now().strftime("%H:%M:%S")
        if self.verbose or level == "ERROR":
            print(f"[{timestamp}] [{level}] {message}")

    def resolve_dns_record(self, domain, record_type):
        """Resolve a specific DNS record type"""
        try:
            resolver = dns.resolver.Resolver()
            resolver.timeout = 5
            resolver.lifetime = 5
            
            answers = resolver.resolve(domain, record_type)
            records = []
            
            for answer in answers:
                records.append(str(answer))
            
            return records
        except dns.resolver.NXDOMAIN:
            self.log(f"Domain {domain} does not exist", "ERROR")
            return []
        except dns.resolver.NoAnswer:
            return []
        except dns.resolver.Timeout:
            self.log(f"Timeout resolving {record_type} record for {domain}", "ERROR")
            return []
        except Exception as e:
            self.log(f"Error resolving {record_type} record for {domain}: {str(e)}", "ERROR")
            return []

    def enumerate_dns_records(self):
        """Enumerate all DNS record types for the domain"""
        self.log(f"Starting DNS record enumeration for {self.domain}")
        
        for record_type in self.record_types:
            self.log(f"Checking {record_type} records...")
            records = self.resolve_dns_record(self.domain, record_type)
            
            if records:
                self.results['records'][record_type] = records
                self.log(f"Found {len(records)} {record_type} record(s): {', '.join(records)}")
            else:
                self.log(f"No {record_type} records found")

    def enumerate_subdomains(self):
        """Enumerate subdomains using brute force"""
        self.log(f"Starting subdomain enumeration for {self.domain}")
        
        def check_subdomain(subdomain):
            full_domain = f"{subdomain}.{self.domain}"
            try:
                # Try to resolve A record
                records = self.resolve_dns_record(full_domain, 'A')
                if records:
                    self.results['subdomains'].append({
                        'subdomain': full_domain,
                        'ip': records[0],
                        'timestamp': datetime.now().isoformat()
                    })
                    self.log(f"Found subdomain: {full_domain} -> {records[0]}")
                    return True
            except Exception as e:
                pass
            return False

        # Use ThreadPoolExecutor for concurrent subdomain checking
        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            futures = {executor.submit(check_subdomain, subdomain): subdomain 
                      for subdomain in self.subdomain_wordlist}
            
            for future in as_completed(futures):
                subdomain = futures[future]
                try:
                    future.result()
                except Exception as e:
                    self.log(f"Error checking subdomain {subdomain}: {str(e)}", "ERROR")

    def reverse_dns_lookup(self, ip):
        """Perform reverse DNS lookup"""
        try:
            hostname = socket.gethostbyaddr(ip)[0]
            return hostname
        except socket.herror:
            return None

    def zone_transfer(self):
        """Attempt DNS zone transfer"""
        self.log("Attempting DNS zone transfer...")
        
        # Get NS records first
        ns_records = self.results['records'].get('NS', [])
        
        for ns in ns_records:
            try:
                self.log(f"Attempting zone transfer from {ns}")
                zone = dns.zone.from_xfr(dns.query.xfr(ns, self.domain))
                
                zone_records = []
                for name, node in zone.nodes.items():
                    for rdataset in node.rdatasets:
                        for rdata in rdataset:
                            zone_records.append({
                                'name': str(name),
                                'type': str(rdataset.rdtype),
                                'data': str(rdata)
                            })
                
                if zone_records:
                    self.results['zone_transfer'] = {
                        'nameserver': ns,
                        'records': zone_records
                    }
                    self.log(f"Zone transfer successful from {ns}, found {len(zone_records)} records")
                    break
                    
            except Exception as e:
                self.log(f"Zone transfer failed from {ns}: {str(e)}", "ERROR")

    def check_common_ports(self, domain):
        """Check common ports on discovered IPs"""
        common_ports = [21, 22, 23, 25, 53, 80, 110, 143, 443, 993, 995, 3389, 5432, 3306, 6379, 27017]
        
        for subdomain_info in self.results['subdomains']:
            ip = subdomain_info['ip']
            self.log(f"Checking ports on {ip}")
            
            open_ports = []
            for port in common_ports:
                try:
                    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                    sock.settimeout(1)
                    result = sock.connect_ex((ip, port))
                    if result == 0:
                        open_ports.append(port)
                    sock.close()
                except Exception:
                    pass
            
            if open_ports:
                subdomain_info['open_ports'] = open_ports
                self.log(f"Open ports on {ip}: {', '.join(map(str, open_ports))}")

    def generate_report(self, output_format='json'):
        """Generate report in specified format"""
        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
        
        if output_format == 'json':
            filename = f"dns_enum_report_{self.domain}_{timestamp}.json"
            with open(filename, 'w') as f:
                json.dump(self.results, f, indent=2)
            self.log(f"JSON report saved to {filename}")
            
        elif output_format == 'csv':
            filename = f"dns_enum_report_{self.domain}_{timestamp}.csv"
            with open(filename, 'w', newline='') as f:
                writer = csv.writer(f)
                writer.writerow(['Type', 'Domain', 'Value', 'Timestamp'])
                
                # Write DNS records
                for record_type, records in self.results['records'].items():
                    for record in records:
                        writer.writerow([record_type, self.domain, record, self.results['timestamp']])
                
                # Write subdomains
                for subdomain_info in self.results['subdomains']:
                    writer.writerow(['SUBDOMAIN', subdomain_info['subdomain'], 
                                   subdomain_info['ip'], subdomain_info['timestamp']])
            
            self.log(f"CSV report saved to {filename}")
            
        elif output_format == 'txt':
            filename = f"dns_enum_report_{self.domain}_{timestamp}.txt"
            with open(filename, 'w') as f:
                f.write(f"DNS Enumeration Report for {self.domain}\n")
                f.write(f"Generated: {self.results['timestamp']}\n")
                f.write("=" * 50 + "\n\n")
                
                # DNS Records
                f.write("DNS RECORDS:\n")
                f.write("-" * 20 + "\n")
                for record_type, records in self.results['records'].items():
                    f.write(f"{record_type}:\n")
                    for record in records:
                        f.write(f"  {record}\n")
                    f.write("\n")
                
                # Subdomains
                f.write("SUBDOMAINS:\n")
                f.write("-" * 20 + "\n")
                for subdomain_info in self.results['subdomains']:
                    f.write(f"{subdomain_info['subdomain']} -> {subdomain_info['ip']}\n")
                    if 'open_ports' in subdomain_info:
                        f.write(f"  Open ports: {', '.join(map(str, subdomain_info['open_ports']))}\n")
                f.write("\n")
            
            self.log(f"Text report saved to {filename}")

    def run_full_enumeration(self):
        """Run complete DNS enumeration"""
        start_time = time.time()
        
        self.log("Starting comprehensive DNS enumeration...")
        
        # Step 1: Enumerate DNS records
        self.enumerate_dns_records()
        
        # Step 2: Enumerate subdomains
        self.enumerate_subdomains()
        
        # Step 3: Attempt zone transfer
        self.zone_transfer()
        
        # Step 4: Check common ports on discovered IPs
        self.check_common_ports(self.domain)
        
        # Step 5: Generate reports
        self.generate_report('json')
        self.generate_report('csv')
        self.generate_report('txt')
        
        end_time = time.time()
        duration = end_time - start_time
        
        self.log(f"Enumeration completed in {duration:.2f} seconds")
        self.log(f"Found {len(self.results['records'])} record types")
        self.log(f"Found {len(self.results['subdomains'])} subdomains")
        
        return self.results

def main():
    parser = argparse.ArgumentParser(description='DNS Records Enumeration Tool')
    parser.add_argument('domain', help='Target domain to enumerate')
    parser.add_argument('-v', '--verbose', action='store_true', help='Verbose output')
    parser.add_argument('-t', '--threads', type=int, default=10, help='Number of threads (default: 10)')
    parser.add_argument('-o', '--output', choices=['json', 'csv', 'txt', 'all'], default='all', 
                       help='Output format (default: all)')
    parser.add_argument('--subdomains-only', action='store_true', help='Only enumerate subdomains')
    parser.add_argument('--records-only', action='store_true', help='Only enumerate DNS records')
    
    args = parser.parse_args()
    
    # Create DNS enumeration tool instance
    dns_tool = DNSEnumTool(args.domain, args.verbose, args.threads)
    
    try:
        if args.subdomains_only:
            dns_tool.enumerate_subdomains()
        elif args.records_only:
            dns_tool.enumerate_dns_records()
        else:
            dns_tool.run_full_enumeration()
            
    except KeyboardInterrupt:
        print("\n[!] Enumeration interrupted by user")
        sys.exit(1)
    except Exception as e:
        print(f"[!] Error: {str(e)}")
        sys.exit(1)

if __name__ == "__main__":
    main()