Fast CLI DNS Lookup Tool.
ZDNS is a command-line utility that provides high-speed DNS lookups. For example, the following will perform MX lookups and a secondary A lookup for the IPs of MX servers for the domains in the Alexa Top Million:
cat top-1m.csv | zdns MX --ipv4-lookup --alexa
ZDNS is written in golang and is primarily based on https://github.com/miekg/dns.
Install
ZDNS can be installed by running:
go get github.com/zmap/zdns/zdns
Usage
ZDNS provides several types of modules.
Raw DNS Modules
The
A
, AAAA
, ANY
, AXFR
, CAA
, CNAME
, DMARC
, MX
, NS
, PTR
, TXT
, SOA
, and SPF
modules provide the raw DNS response in JSON form, similar to dig.
For example, the command:
echo "censys.io" | zdns A
returns:
{
"name": "censys.io",
"class": "IN",
"status": "NOERROR",
"data": {
"answers": [
{
"ttl": 300,
"type": "A",
"class": "IN",
"name": "censys.io",
"data": "216.239.38.21"
}
],
"additionals": [
{
"ttl": 34563,
"type": "A",
"class": "IN",
"name": "ns-cloud-e1.googledomains.com",
"data": "216.239.32.110"
},
],
"authorities": [
{
"ttl": 53110,
"type": "NS",
"class": "IN",
"name": "censys.io",
"data": "ns-cloud-e1.googledomains.com."
},
],
"protocol": "udp"
}
}
Trace DNS Delegation
echo "censys.io" | ./zdns a --trace
returns:
json { ... }
Lookup Modules
Raw DNS responses frequently do not provide the data you want. For example, an MX response may not include the associated A records in the additionals section requiring an additional lookup. To address this gap and provide a friendlier interface, we also provide several lookup modules:
alookup
and mxlookup
.mxlookup
will additionally do an A lookup for the IP addresses that correspond with an exchange record. alookup
acts similar to nslookup and will follow CNAME records.
For example,
echo "censys.io" | ./zdns mxlookup --ipv4-lookup
returns:
{
"name": "censys.io",
"status": "NOERROR",
"data": {
"exchanges": [
{
"name": "aspmx.l.google.com",
"type": "MX",
"class": "IN",
"preference": 1,
"ipv4_addresses": [
"74.125.28.26"
],
"ttl": 288
},
{
"name": "alt1.aspmx.l.google.com",
"type": "MX",
"class": "IN",
"preference": 5,
"ipv4_addresses": [
"64.233.182.26"
],
"ttl": 288
}
]
}
}
Local Recursion
ZDNS can either operate against a recursive resolver (e.g., an organizational DNS server) [default behavior] or can perform its own recursion internally. To perform local recursion, run zdns with the
--iterative
flag. When this flag is used, ZDNS will round-robin between the published root servers (e.g., 198.41.0.4). In iterative mode, you can control the size of the local cache by specifying --cache-size
and the timeout for individual iterations by setting --iteration-timeout
. The --timeout
flag controls the timeout of the entire resolution for a given input (i.e., the sum of all iterative steps).Running ZDNS
By default, ZDNS will operate with 1,000 light-weight go routines. If you're not careful, this will overwhelm many upstream DNS providers. We suggest that users coordinate with local network administrators before performing any scans. You can control the number of concurrent connections with the
--threads
and --go-processes
command line arguments. Alternate name servers can be specified with --name-servers
. ZDNS will rotate through these servers when making requests.Unsupported Types
If zdns encounters a record type it does not support it will generate an output record with the
type
field set correctly and a representation of the underlying data structure in the unparsed_rr
field. Do not rely on the presence or structure of this field. This field (and its existence) may change at any time as we expand support for additional record types. If you find yourself using this field, please consider submitting a pull-request adding parser support.
No comments:
Post a Comment