forked from rituallyunclean/NSE_2
-
Notifications
You must be signed in to change notification settings - Fork 0
/
http-robtex-shared-ns.nse
112 lines (92 loc) · 2.73 KB
/
http-robtex-shared-ns.nse
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
local http = require "http"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
description = [[
Finds up to 100 domain names which use the same name server as the target by querying the Robtex service at http://www.robtex.com/dns/.
The target must be specified by DNS name, not IP address.
]]
---
-- @usage
-- nmap --script http-robtex-shared-ns
--
-- @output
-- Host script results:
-- | http-robtex-shared-ns:
-- | example.edu
-- | example.net
-- | example.edu
-- |_ example.net
-- (some results omitted for brevity)
--
-- TODO:
-- * Add list of nameservers, or group output accordingly
--
author = "Arturo Busleiman <[email protected]>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "safe", "external"}
local function unescape(s)
return string.gsub(s, "\\x(%x%x)", function(hex)
return string.char(tonumber(hex, 16))
end)
end
--- Scrape domains sharing name servers from robtex website
-- @param data string containing the retrieved web page
-- @return table containing the resolved host names
function parse_robtex_response(data)
local result = {}
-- cut out the section we're interested in
data = data:match("<span id=\\\"sharednss?\\\">.-<ul.->(.-)</ul>")
if ( not(data) ) then
return
end
-- process each html list item
for li in data:gmatch("<li>(.-)</li>") do
local domain = li:match("<a.->(.*)</a>")
if ( domain ) then
table.insert(result, domain)
end
end
return result
end
local function lookup_dns_server(data)
return data:match("The primary name server is <a.->(.-)</a>.")
end
local function fetch_robtex_data(url)
local htmldata = http.get_url(url)
if ( not(htmldata) or not(htmldata.body) ) then
return
end
local url = htmldata.body:match("var%s*uurl%s*='([^']*)")
if ( not(url) ) then
return
end
-- retreive the url having the shared dns information
htmldata = http.get_url(url)
if ( not(htmldata) or not(htmldata.body) ) then
return
end
-- fixup line breaks
htmldata = htmldata.body:gsub("(.-)\\\r?\n", "%1")
-- fixup hex encodings
return unescape(htmldata)
end
hostrule = function (host) return host.targetname end
action = function(host)
local base_url = "http://www.robtex.com/dns/%s.html"
local data = fetch_robtex_data(base_url:format(host.targetname))
local domains = parse_robtex_response(data)
if ( not(domains) ) then
local server = lookup_dns_server(data)
if ( not(server) ) then
return
end
local url = base_url:format(server)
stdnse.print_debug(2, "%s: Querying URL: %s", SCRIPT_NAME, url)
data = fetch_robtex_data(url)
domains = parse_robtex_response(data)
end
if (domains and #domains > 0) then
return stdnse.format_output(true, domains)
end
end