DioNiSio man page
NAME
dionisio - fast and simple DNS scanner
SYNOPSIS
dionisio [OPTION] target_domain [...]
dionisio -r
[OPTION] ip_range [...]
dionisio -x
[OPTION] target_domain
dionisio -u
[OPTION] dump_file
DESCRIPTION
DioNiSio is a DNS scanner written in pure C without any dependence on other
libraries or tools. It implements three scans types (dictionary, reverse lookup
and recursive zone transfers) and can detect DNS misconfigurations or
anomalities. Its main targets are portability, rational resources usage, and
ease of use.
It can perform three types of scan:
- *
-
Dictionary scan. DioNiSio can read a dictionary and try to resolve hosts in a
certain domain. It can detect subdomains and analyzes all responses to discover
more hostnames. In the spite of the simplicity of this kind of scan the results
obtained with this scan can be impressive and can show a bad policy in choosing
host names in a network.
- *
-
Reverse scan. DioNiSio can make mass reverse lookups in a network. A lot of
administrators configure their DNS servers so they make the reverse address
lookup of any host. This can be used to gather a lot of information in a
network; the final result is like a network scan but using only DNS questions,
so it is not easy to detect and sometimes gives a lot of information extra that
you cannot obtain simply with a traditional network scanner like nmap.
- *
-
Recursive zone transfer. This scan is developed specially for penetration
tests. Usually DNS servers doesn't allow zone transfers to external IP
addresses, but a lof of administrators allow zone transfer to any machine in
their networks. When an auditor gets control on a machine, and he is working
under the black-box paradigm, he will need surely to gather more information
from her/his new point of view and one good way could be to make an agressive
zone transfers. The problem is that a compromised machine usually have not
installed the necessary tools; DioNiSio is targeted to be completely
independent from system libraries, easy to port and low memory and CPU
consumption.
Also DioNiSio can manage a pool of recursive DNS servers so it can make
distributed DNS scans (only dictionary and reverse scans). A distributed DNS
scan is usually hard to detect and give an extra layer of protection to your
identity.
OPTIONS
- -c, --comments
-
Add comments to output. Note that this flag does not give any extra
information, it only gives some additional commentaries that would ease the
human analysis.
- -d, --dictionary
-
Dictionary scanner. This attack consists to discover machines in a domain in a
bruteforce way applying a dictionary, word by word. Each time a new subdomain
is discovered, the dictionary attack is applied recursively.
- -D, --domain-test
-
Do a domain analysis on each new domain found. It means that DioNiSio will try
to resolve domain name servers and, if --axfr-test enabled, then it tries to
make zone transfers from name servers in discovered domain. This test will also
try to found some other information.
- -f value, --max-fail=value
-
Max fails per nameserver.
- -g, --debug
-
Debug mode (all possible messages).
- -h, --help
-
Help.
- -H, --host-test
-
Do a host analysis on each new HOST found. It means that DioNiSio will make
some questions about each new host discovered (MX, SOA, NS, A, AAAA, etc).
- -l path, --ns-list=path
-
Path to nameservers list.
- -m mode, --mode=mode
-
Set scanner mode. Valid values:
-
- 0
-
Recursive zone transfer (same as -x).
- 1
-
Dictionary analysis (same as -d).
- 2
-
Reverse lookup network analysis (same as -r).
- 3
-
Read dump (same as -u).
- -M mode, --follow-mode=mode
-
How to follow new discovered domains. Each time a new domain/host is discovered
DioNiSio must decide if it has to continue to investigate on it or leave it
alone. Accepted values:
-
- 0
-
Follow only subdomains.
- 1
-
Follow any domain.
- 2
-
Ask to follow new domains (not implemented yet).
- -n path, --names=path
-
Path to dictionary file for dictionary scanner.
- -o format, --output=format
-
Final report output format.
-
- 0
-
TXT (normal)
- 1
-
CSV (Comma Separated Value)
- -q, --quiet
-
Quiet mode (only errors).
- -r, --reverse
-
Reverse lookup scanner. This scan it is based on making a mass reverse lookup
on indicated network range.
- -R, --reverse-test
-
Do reverse lookup on each new IP found.
- -u, --read-dump
-
Reads dump made with option -U and generates a report from the answers found
in it. It makes possible to debug the program or generate a report in a
different format. Note that if you use a dump to regenerate a report the
resultant report not will be exactly the same, but it will be very similar.
- -U, --dump-file
-
Dumps sent/recvd DNS packets for debugging. The file format used is simple:
divided in DNS packets, where each data packet follows two 32 bit integers: the
first integer is 0 if packet is a question, or 1 if packet is an answer. The
second integer is the packet size.
- -x, --axfr
-
Perform a recursive zone transfer. The idea of a recursive zone transfer is to
make an initial zone transfer, detect subdomains and domains associated in the
answer and then try perform a recursive zone transfer on each.
- -X, --axfr-test
-
Do a zone transfer on each new NS found.
- -v, --verbose[=level]
-
Set verbosity level (default 3).
EXIT STATUS
DioNiSio returns a zero exit status if it succeeds or non zero is returned in
case of failure.
FILES
This program uses following files:
- nslist.txt
-
List of nameservers. This file must contain a list of working recursive DNS
servers. If you want to hide your identity choose them carefully and try to
make this list so big as possible to make the scan the more distributed as
possible.
- dionisio.dic
-
This file contains one word per line. It is used in dictionary scans.
NSLIST.TXT FILE FORMAT
This file can contain comments, void lines and nameservers addresses.
Void lines and comments will be ignored.
Comments begin with a # and they are ignored until new line. There are not
multiline comments. You can also add a comment in a non-void line at the end.
Non-void lines should contain only one IP, in IPv4 or IPv6 format.
For example, one valid file:
# Sample DNS list file.
# verizon servers
4.2.2.2 # Verizon (Level3)
4.2.2.3 # Verizon (Level3)
4.2.2.4 # Verizon (Level3)
4.2.2.5 # Verizon (Level3)
4.2.2.6 # Verizon (Level3)
# other servers
10.0.0.1
10.0.0.254
DUMP FILE FORMAT
A dump file contains all the questions sent and answers received during a
DioNiSio session. A dump file is very useful to restore a DioNiSio session
interrupted by a segmentation fault or by user. It is also very practical for
debugging.
The ''official'' way to create a dump file is using parameter -U.
You only have to invoke DioNiSio adding option -U
filename.dump and all DNS messages will be written to that file.
With mode -u you can read and load all data contained in a dump
file.
Dump file structure is quite simple: it is a succession of messages where each
message is composed of three parts:
- answer
-
32 bit unsigned integer. 0 if this message is a question, or != 0 if this
message is an answer.
- message_size
-
32 bit unsigned integer. It is the size, in bytes, of DNS message following
this integer.
- message
-
A block of data, of message_size bytes containing a DNS message in
network raw format.
For file portability between different platforms all data in file is written in
big endian (network format).
NOTES
This program will react to some signals:
- SIGINT, SIGQUIT, SIGTERM
-
The first and second time one of this signals is received the program will try
to finish everything that is initiated and then it will finish printing the
partial report. If one of this signals is received for third time the program
will be terminated inmediately without printing any result.
- SIGHUP
-
This signal forces DioNiSio to reload the nameservers list (see file
nslist.txt in section FILES) on runtime.
BUGS
This program does not have bugs. It only has crazy, dangerous and unuseful
undocumented features.
EXAMPLES
Do a reverse analysis in network 192.168.0.0/16:
-
dionisio -r 192.168.0.0/16
If you only want to work in some computers in network 192.168.0.0/16, from
192.168.5.10 to 192.168.7.59, you can use this notation:
-
dionisio -r 192.168.5.10-7.59
Perhaps you would like to receive some extra-feedback of analysis adding the
--verbose flag. Also you can use the option -c to get a final report with
some interesting comments.
-
dionisio -vcr 192.168.5.10-7.59
Also, if you plan to use some spreadsheet software to analyse results you will
find interesting to use the CSV output format:
-
dionisio -vcr --output=1 192.168.5.10-7.59
Another working mode could be a dictionary scan on domain example.com
using dictionary /home/ger/dic/nsnames.txt, trying to perform a
zone transfer on each new NS found, and trying to discover more hostnames on
new hosts found with a reverse lookup:
-
dionisio -d --names="/home/ger/dic/nsnames.txt" -XR example.com
Or simply execute a recursive AXFR on domain example.com:
-
dionisio -x example.com
AUTHOR
Gerardo García Peña (gerardo (at) kung-foo.dhs.org)