From cfa788e539f20755a7a83de25b4e4d6ef597275e Mon Sep 17 00:00:00 2001 From: Neo Date: Sat, 11 Feb 2017 12:28:19 +0200 Subject: [PATCH] Fix setup of resolver verification Previously, the resolver instance used by the process is set up with no arguments to the constructor but since the signature of the constructor is: ```python def __init__(self, nameservers = ['8.8.8.8','8.8.4.4']) ``` This actually creates a resolver with the Google DNS servers as the nameservers to use. Then, in the blank test on line [227](https://github.com/TheRook/subbrute/blob/c5b96610129bedcb4c322b8864f67985b3e808f8/subbrute.py#L227), a resolution is made for the blank domain as part of the verification: ```python blanktest = self.resolver.query(self.target, self.query_type) ``` However, since no nameserver is explicitly specified, the Google DNS servers are actually used again for this. This means the verification process actually hits the Google servers at least once for every server they verify and don't actually verify the behaviour of the server itself. --- subbrute.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/subbrute.py b/subbrute.py index 37191cd..3563f1e 100755 --- a/subbrute.py +++ b/subbrute.py @@ -155,7 +155,7 @@ def __init__(self, target, query_type, resolver_q, resolver_list, authoritative self.resolver_q = resolver_q self.query_type = query_type self.resolver_list = resolver_list - self.resolver = resolver() + self.resolver = resolver([]) #The domain provided by the user. self.target = target #Resolvers that will work in a pinch: @@ -224,7 +224,7 @@ def find_wildcards(self, host, server): #2)The target maybe using geolocaiton-aware DNS. #I have seen a CloudFlare Enterprise customer with these two conditions. try: - blanktest = self.resolver.query(self.target, self.query_type) + blanktest = self.resolver.query(self.target, self.query_type, server) if self.query_type == "ANY": #If the type was ANY we should have gotten some records if not len(blanktest) and not self.authoritative: @@ -856,4 +856,4 @@ def signal_init(): target = target.strip() if target: trace(target, record_type, options.subs, options.resolvers, options.process_count, options.print_data, output, json_output) - print_target(target, record_type, options.subs, options.resolvers, options.process_count, options.print_data, output, json_output) \ No newline at end of file + print_target(target, record_type, options.subs, options.resolvers, options.process_count, options.print_data, output, json_output)