在普通的DNS窮舉中，如果使用字典進(jìn)行窮舉，會(huì)發(fā)現(xiàn)沒有哪個(gè)字典能窮舉完所有的域名，國外安全研究者在常年累月的DNS記錄收集中發(fā)現(xiàn)，很多域名有大量的短主機(jī)名，并且很易記，通常為4個(gè)字符或更少，所以有了以下腳本：

<span>#!/usr/bin/env ruby</span><span>#</span><span>## Brute code stolen form.: http://www.myhack58.com/</span><span>#</span><span>@domain</span><span>=</span><span>'microsoft.com'</span><span>def</span><span>result</span><span>?(</span><span>sub</span><span>)</span><span>results = %x</span><span>(</span><span>dig +noall #{sub</span><span>}.#{</span><span>@domain</span><span>} +</span><span>answer</span><span>)</span><span></span><span>if</span><span>results !=</span><span>""</span><span>puts</span><span>"============================"</span><span>puts</span><span>"FOUND: \t#{sub}"</span><span>puts</span><span>"============================"</span><span>puts</span><span>"#{results}"</span><span>puts</span><span>"============================"</span><span>end</span><span>1</span><span>==</span><span>2</span><span>end</span><span>def</span><span>crack_yielding</span><span>(</span><span>chars</span><span>)</span><span>crack_yield</span><span>(</span><span>chars</span><span>){ |</span><span>p</span><span>|</span><span></span><span>return</span><span>p</span><span>if</span><span>result</span><span>?(</span><span>p</span><span>)</span><span>}end</span><span>def</span><span>crack_yield</span><span>(</span><span>chars</span><span>)</span><span>chars</span><span>.</span><span>each { |c</span><span>|</span><span>yield</span><span>c }  crack_yield</span><span>(</span><span>chars</span><span>) { |</span><span>c</span><span>|</span><span>chars</span><span>.</span><span>each</span><span>do</span><span>|x</span><span>|</span><span></span><span>yield</span><span>c + x      end  }endchars = (</span><span>'a'</span><span>..</span><span>'z'</span><span>).</span><span>to_a</span><span>(</span><span>0.</span><span>.</span><span>9</span><span>).</span><span>each {|x</span><span>|</span><span>chars << x</span><span>.</span><span>to_s</span><span>}</span><span>crack_yielding</span><span>(</span><span>chars</span><span>)</span>

    gist: http://www.myhack58.com/mubix/9107284

    它能正常運(yùn)行，但是速度比較慢，所以進(jìn)行了改進(jìn)，

DNS迭代窮舉腳本腳本安全

<span>#!/usr/bin/env ruby</span><span>#</span><span>## Brute code stolen form.: https://gist.github.com/petehamilton/4755855</span><span>#</span><span>def</span><span>result</span><span>?(</span><span>sub</span><span>)</span><span>puts sub</span><span>1</span><span>==</span><span>2</span><span>end</span><span>def</span><span>crack_yielding</span><span>(</span><span>chars</span><span>)</span><span>crack_yield</span><span>(</span><span>chars</span><span>){ |</span><span>p</span><span>|</span><span></span><span>return</span><span>p</span><span>if</span><span>result</span><span>?(</span><span>p</span><span>)</span><span>}</span><span>end</span><span>def</span><span>crack_yield</span><span>(</span><span>chars</span><span>)</span><span>chars</span><span>.</span><span>each { |c</span><span>|</span><span>yield</span><span>c }  crack_yield</span><span>(</span><span>chars</span><span>) { |</span><span>c</span><span>|</span><span>chars</span><span>.</span><span>each</span><span>do</span><span>|x</span><span>|</span><span></span><span>yield</span><span>c + x</span><span>end</span><span>}</span><span>end</span><span>chars = (</span><span>'a'</span><span>..</span><span>'z'</span><span>).</span><span>to_a</span><span>(</span><span>0.</span><span>.</span><span>9</span><span>).</span><span>each {|x</span><span>|</span><span>chars << x</span><span>.</span><span>to_s</span><span>}</span><span>crack_yielding</span><span>(</span><span>chars</span><span>)</span>

    開始使用

<span>ruby brutelist</span><span>.</span><span>rb | parallel -j100 dig +noall {}</span><span>.</span><span>microsoft</span><span>.</span><span>com +answer</span>

    工作回顯如下所示：

<span>c</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>2</span><span>IN  CNAME   c</span><span>.</span><span>microsoft</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>c</span><span>.</span><span>microsoft</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>499</span><span>IN  A</span><span>65.55</span><span>.</span><span>58.184</span><span>e</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>3599</span><span>IN  A</span><span>191.234</span><span>.</span><span>1.50</span><span>g</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>2798</span><span>IN  CNAME   g</span><span>.</span><span>msn</span><span>.</span><span>com</span><span>.</span><span>g</span><span>.</span><span>msn</span><span>.</span><span>com</span><span>.</span><span>99</span><span>IN  CNAME   g</span><span>.</span><span>msn</span><span>.</span><span>com</span><span>.</span><span>nsatc</span><span>.</span><span>net</span><span>.</span><span>g</span><span>.</span><span>msn</span><span>.</span><span>com</span><span>.</span><span>nsatc</span><span>.</span><span>net</span><span>.</span><span>148</span><span>IN  A</span><span>131.253</span><span>.</span><span>34.154</span><span>i</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>779</span><span>IN  CNAME   i</span><span>.</span><span>toggle</span><span>.</span><span>www</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>i</span><span>.</span><span>toggle</span><span>.</span><span>www</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>44</span><span>IN  CNAME   i</span><span>.</span><span>g</span><span>.</span><span>www</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>i</span><span>.</span><span>g</span><span>.</span><span>www</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>225</span><span>IN  CNAME   i</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>edgesuite</span><span>.</span><span>net</span><span>.</span><span>i</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>edgesuite</span><span>.</span><span>net</span><span>.</span><span>116</span><span>IN CNAME   a1475</span><span>.</span><span>g</span><span>.</span><span>akamai</span><span>.</span><span>net</span><span>.</span><span>a1475</span><span>.</span><span>g</span><span>.</span><span>akamai</span><span>.</span><span>net</span><span>.</span><span>16</span><span>IN  A</span><span>23.45</span><span>.</span><span>65.26</span><span>a1475</span><span>.</span><span>g</span><span>.</span><span>akamai</span><span>.</span><span>net</span><span>.</span><span>16</span><span>IN  A</span><span>23.45</span><span>.</span><span>65.33</span><span>m</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>3599</span><span>IN  CNAME   origin</span><span>.</span><span>mobile</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>origin</span><span>.</span><span>mobile</span><span>.</span><span>ms</span><span>.</span><span>akadns</span><span>.</span><span>net</span><span>.</span><span>299</span><span>IN   A</span><span>65.55</span><span>.</span><span>186.235</span><span>s</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>3599</span><span>IN  CNAME   reroute</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>reroute</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>3599</span><span>IN  A</span><span>65.55</span><span>.</span><span>58.201</span><span>reroute</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>3599</span><span>IN  A</span><span>64.4</span><span>.</span><span>11.37</span><span>cs</span><span>.</span><span>microsoft</span><span>.</span><span>com</span><span>.</span><span>81</span><span>IN  CNAME   wedcs</span><span>.</span><span>trafficmanager</span><span>.</span><span>net</span><span>.</span><span>wedcs</span><span>.</span><span>trafficmanager</span><span>.</span><span>net</span><span>.</span><span>7</span><span>IN  CNAME   wedcseus</span><span>.</span><span>cloudapp</span><span>.</span><span>net</span><span>.</span><span>wedcseus</span><span>.</span><span>cloudapp</span><span>.</span><span>net</span><span>.</span><span>8</span><span>IN  A</span><span>137.116</span><span>.</span><span>48.250</span>