Dnsbf.py

Fiche express
Domaine	Découverte d'hôtes par DNS inverse
Outil	dnsbf.py (script Python)
Voir aussi	Dnsdic.py · Dig

dnsbf.py (auteur : t0ka7a) balaie une plage réseau en notation CIDR et effectue une résolution DNS inverse sur chaque adresse pour retrouver les noms d'hôtes associés à un sous-réseau. Le script est multithreadé (sémaphore limitant le nombre de threads simultanés).

Usage

On fournit la plage en notation CIDR (Classless Inter-Domain Routing) :

./dnsbf.py 192.168.132.1/24

Source

#!/usr/bin/python
# dnsbf.py - script written by t0ka7a - licence new BSD
# using dns, find hostnames in a subnet

from socket import gethostbyaddr
import threading
import sys
import time

NB_OF_THREADS_MAX = 200

def use(msg):
    sys.stderr.write("%s\n\n" % msg)
    sys.stderr.write("exemple: %s 192.168.1.0/24\n\n" % sys.argv[0])
    sys.exit(1)

def list_ip(network):
    # network : chaine 'x.x.x.x/nn' -> retourne la liste des IP du sous-reseau
    if len(network.split('/')) != 2:
        use("syntax error (/)")
    netmask = network.split('/')[1]
    try:
        netmask = int(netmask)
    except:
        use("syntax error (netmask not digit)")
    if netmask > 32:
        use("syntax error (netmask > 32)")
    ip_list = network.split('/')[0].split('.')
    if len(ip_list) != 4:
        use("syntax error (ip not x.x.x.x)")
    for i in range(4):
        try:
            if int(ip_list[i]) > 0xFF:
                use("syntax error (numbers upper than 255)")
        except:
            use("syntax error (not digit characters in ip)")
    ip = (int(ip_list[0]) << 24) + (int(ip_list[1]) << 16) + (int(ip_list[2]) << 8) + int(ip_list[3])
    mask_ip = 0
    for i in range(32 - netmask + 1):
        mask_ip |= 1 << i
    output = []
    for i in range(ip, min(ip + mask_ip, 0xFFFFFFFF)):
        output.append("%d.%d.%d.%d" % ((i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF))
    return output

def show_name(ip):
    global nb_of_names_found
    try:
        sys.stdout.write("%s %s\n" % (ip, gethostbyaddr(ip)[0]))
        lock.acquire()
        nb_of_names_found += 1
        lock.release()
    except:
        pass
    semaphore.release()

def main():
    begin = time.time()
    global lock, nb_of_names_found, semaphore
    lock = threading.Lock()
    nb_of_names_found = 0
    semaphore = threading.BoundedSemaphore(value=NB_OF_THREADS_MAX)
    if len(sys.argv) == 2:
        net = list_ip(sys.argv[1])
    else:
        use("wrong number of arguments")
    for ip_to_test in net:
        semaphore.acquire()
        t = threading.Thread(None, show_name, None, (ip_to_test,), None)
        try:
            t.start()
        except:
            use("can't start so many threads.")
    while threading.activeCount() != 1:
        time.sleep(2)
    sys.stdout.write("\n%i ip tested, %i names found, in %i s\n" % (len(net), nb_of_names_found, int(time.time() - begin)))

main()

Voir aussi

• Dnsdic.py — recherche de sous-domaines par dictionnaire
• Dig — force brute de résolution inverse en une ligne shell