Dnsx

DNSX DNS Herramienta Cheat Sheet

Overview

DNSx es un kit de herramientas DNS rápido y multipropósito desarrollado por Project Discovery que permite ejecutar múltiples sondas DNS utilizando la biblioteca de retrígidos. Está diseñado para realizar varias consultas DNS con un enfoque en velocidad y fiabilidad. DNSx puede manejar múltiples tipos de discos DNS y admite fallos personalizados, por lo que es una herramienta versátil para el reconocimiento y la enumeración de DNS.

Lo que distingue a DNSx de otras herramientas DNS es su capacidad para procesar un gran número de dominios de manera eficiente y sus capacidades de integración con otras herramientas de seguridad. Puede filtrar registros de DNS comodín, realizar DNS caminando y extraer información valiosa de las respuestas DNS. DNSx se utiliza comúnmente en la fase de reconocimiento de las evaluaciones de seguridad para reunir información sobre los dominios de destino y su infraestructura.

DNSx admite varios formatos de entrada y se puede integrar fácilmente con otras herramientas en un oleoducto, lo que lo convierte en un componente esencial en muchos flujos de trabajo de pruebas de seguridad. Su capacidad de filtrar los resultados basado en diversos criterios ayuda a los profesionales de la seguridad a centrarse en los objetivos más relevantes.

Instalación

Usando Go

# Install using Go (requires Go 1.20 or later)
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

# Verify installation
dnsx -version

Usando Docker

# Pull the latest Docker image
docker pull projectdiscovery/dnsx:latest

# Run DNSx using Docker
docker run -it projectdiscovery/dnsx:latest -h

Usando Homebrew (macOS)

# Install using Homebrew
brew install dnsx

# Verify installation
dnsx -version

Usando PDTM (Project Discovery Tools Manager)

# Install PDTM first if not already installed
go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest

# Install DNSx using PDTM
pdtm -i dnsx

# Verify installation
dnsx -version

On Kali Linux

# Install using apt
sudo apt install dnsx

# Verify installation
dnsx -version

Uso básico

DNS Lookups

# Perform A record lookup for a single domain
dnsx -d example.com -a

# Perform A record lookup for multiple domains
dnsx -d example.com,hackerone.com -a

# Perform A record lookup from a list of domains
dnsx -l domains.txt -a

# Perform A record lookup from STDIN
cat domains.txt|dnsx -a

Record Types

# Query A records (IPv4 addresses)
dnsx -l domains.txt -a

# Query AAAA records (IPv6 addresses)
dnsx -l domains.txt -aaaa

# Query CNAME records (Canonical names)
dnsx -l domains.txt -cname

# Query NS records (Name servers)
dnsx -l domains.txt -ns

# Query TXT records (Text records)
dnsx -l domains.txt -txt

# Query MX records (Mail exchange servers)
dnsx -l domains.txt -mx

# Query SOA records (Start of authority)
dnsx -l domains.txt -soa

# Query PTR records (Pointer records)
dnsx -l domains.txt -ptr

# Query multiple record types
dnsx -l domains.txt -a -cname -ns

Output Options

# Save results to a file
dnsx -l domains.txt -a -o results.txt

# Output in JSON format
dnsx -l domains.txt -a -json -o results.json

# Output in CSV format
dnsx -l domains.txt -a -csv -o results.csv

# Silent mode (only results)
dnsx -l domains.txt -a -silent

Advanced Usage

Resolver Configuration

# Use specific DNS resolvers
dnsx -l domains.txt -a -resolver 1.1.1.1,8.8.8.8

# Use resolvers from a file
dnsx -l domains.txt -a -resolver-file resolvers.txt

# Use system resolvers
dnsx -l domains.txt -a -system-resolver

Response Filtering

# Filter by response containing specific string
dnsx -l domains.txt -a -resp-only -resp "1.2.3.4"

# Filter by response matching regex
dnsx -l domains.txt -a -resp-only -resp-regex "^1\.2\.[0-9]+\.[0-9]+$"

Wildcard Filtering

# Enable wildcard filtering
dnsx -l domains.txt -a -wildcard

# Set wildcard threshold
dnsx -l domains.txt -a -wildcard-threshold 5

DNS Walking

# Enable DNS walking
dnsx -l domains.txt -a -walk

# Set DNS walking threads
dnsx -l domains.txt -a -walk -walk-threads 20

Performance Optimization

Concurrencia y limitación de tarifas

# Set concurrency (default: 100)
dnsx -l domains.txt -a -c 200

# Set rate limit
dnsx -l domains.txt -a -rate-limit 100

# Set retries
dnsx -l domains.txt -a -retries 3

Timeout Options

# Set timeout for DNS queries (milliseconds)
dnsx -l domains.txt -a -timeout 5000

Optimización para grandes escáneres

# Use stream mode for large inputs
dnsx -l large-domains.txt -a -stream

# Increase concurrency for faster scanning
dnsx -l domains.txt -a -c 500

Integración con otras herramientas

Pipeline with Subfinder

# Find subdomains and resolve them
subfinder -d example.com -silent|dnsx -a -silent

# Find subdomains and check for specific record types
subfinder -d example.com -silent|dnsx -a -cname -silent

Pipeline with HTTPX

# Resolve domains and probe for HTTP services
dnsx -l domains.txt -a -silent|httpx -silent

# Resolve domains, filter by IP, and probe for HTTP services
dnsx -l domains.txt -a -silent -resp "1.2.3.4"|httpx -silent

Pipeline with Naabu

# Resolve domains and scan for open ports
dnsx -l domains.txt -a -silent|naabu -silent

# Resolve domains, filter by IP, and scan for open ports
dnsx -l domains.txt -a -silent -resp "1.2.3.4"|naabu -silent

Output Customization

Custom Output Format

# Output only domain and IP
dnsx -l domains.txt -a -resp-only

# Output with additional information
dnsx -l domains.txt -a -json

# Count unique IPs
dnsx -l domains.txt -a -resp-only|sort -u|wc -l

# Sort output by IP
dnsx -l domains.txt -a -resp-only|sort -t ' ' -k2

Filtrando salida

# Filter by IP
dnsx -l domains.txt -a -resp-only|grep "1.2.3.4"

# Filter by domain
dnsx -l domains.txt -a -resp-only|grep "example.com"

# Find unique IPs
dnsx -l domains.txt -a -resp-only|awk '\\\\{print $2\\\\}'|sort -u

Filtro avanzado

Filtro IP

# Filter by specific IP
dnsx -l domains.txt -a -resp-only -resp "1.2.3.4"

# Filter by IP range
dnsx -l domains.txt -a -resp-only -resp-regex "^1\.2\.3\.[0-9]+$"

Filtro de dominio

# Filter by domain pattern
dnsx -l domains.txt -a -resp-only|grep "api"

# Filter by specific TLD
dnsx -l domains.txt -a -resp-only|grep "\.com$"

CNAME Filtro

# Find domains with specific CNAME
dnsx -l domains.txt -cname -resp-only -resp "cdn.example.com"

# Find domains with CNAME pointing to specific services
dnsx -l domains.txt -cname -resp-only -resp-regex "amazonaws\.com$"

Miscelánea Características

Inverso DNS Lookup

# Perform reverse DNS lookup
dnsx -l ips.txt -ptr

# Perform reverse DNS lookup with response filtering
dnsx -l ips.txt -ptr -resp-only -resp "example.com"

DNS Trace

# Perform DNS trace
dnsx -d example.com -trace

# Perform DNS trace with specific resolver
dnsx -d example.com -trace -resolver 1.1.1.1

Health Check

# Check resolver health
dnsx -hc -resolver 1.1.1.1,8.8.8.8

# Check resolver health with timeout
dnsx -hc -resolver 1.1.1.1,8.8.8.8 -timeout 5000

Troubleshooting

Common Issues

1. ** Cuestiones de resolución**

      # Try different resolvers
      dnsx -l domains.txt -a -resolver 1.1.1.1,8.8.8.8
   
      # Check resolver health
      dnsx -hc -resolver 1.1.1.1,8.8.8.8
      ```
   
   2. ** Problemas de tiempo**
   ```bash
      # Increase timeout
      dnsx -l domains.txt -a -timeout 10000
   
      # Increase retries
      dnsx -l domains.txt -a -retries 5
      ```
   
   3. ** Limitación de destino**
   ```bash
      # Reduce concurrency
      dnsx -l domains.txt -a -c 50
   
      # Set rate limit
      dnsx -l domains.txt -a -rate-limit 50
      ```
   
   4. * Problemas de memoria*
   ```bash
      # Use stream mode for large inputs
      dnsx -l large-domains.txt -a -stream
      ```
   
   ### Debugging
   
   ```bash
   # Enable verbose mode
   dnsx -l domains.txt -a -v
   
   # Show debug information
   dnsx -l domains.txt -a -debug
   
   # Show statistics
   dnsx -l domains.txt -a -stats
   

Configuración

Archivo de configuración

DNSx utiliza un archivo de configuración ubicado en $HOME/.config/dnsx/config.yaml_. Puede personalizar varios ajustes en este archivo:

# Example configuration file
concurrency: 100
rate-limit: 100
retries: 3
timeout: 5000
resolvers:
  - 1.1.1.1
  - 8.8.8.8

Environment Variables

# Set DNSx configuration via environment variables
export DNSX_CONCURRENCY=100
export DNSX_RATE_LIMIT=100
export DNSX_RETRIES=3
export DNSX_TIMEOUT=5000
export DNSX_RESOLVERS=1.1.1.1,8.8.8.8

Reference

Command Line Options

Flag	Description
INLINE_CODE_34	Target domain to query
INLINE_CODE_35	File containing list of domains to query
INLINE_CODE_36	Query A records
INLINE_CODE_37	Query AAAA records
INLINE_CODE_38	Query CNAME records
INLINE_CODE_39	Query NS records
INLINE_CODE_40	Query TXT records
INLINE_CODE_41	Query MX records
INLINE_CODE_42	Query SOA records
INLINE_CODE_43	Query PTR records
INLINE_CODE_44	File to write output to
INLINE_CODE_45	Write output in JSON format
INLINE_CODE_46	Write output in CSV format
INLINE_CODE_47	Show only results in output
INLINE_CODE_48	Show verbose output
INLINE_CODE_49	DNS resolvers to use
INLINE_CODE_50	File containing DNS resolvers
INLINE_CODE_51	Use system resolvers
INLINE_CODE_52	Show only response in output
INLINE_CODE_53	Filter response containing string
INLINE_CODE_54	Filter response matching regex
INLINE_CODE_55	Enable wildcard filtering
INLINE_CODE_56	Wildcard filtering threshold
INLINE_CODE_57	Enable DNS walking
INLINE_CODE_58	Number of DNS walking threads
INLINE_CODE_59	Number of concurrent queries
INLINE_CODE_60	Maximum number of queries per second
INLINE_CODE_61	Number of retries for failed queries
INLINE_CODE_62	Timeout for DNS queries in milliseconds
INLINE_CODE_63	Stream mode for large inputs
INLINE_CODE_64	Check resolver health
INLINE_CODE_65	Perform DNS trace
INLINE_CODE_66	Show DNSx version

Record Types

Type	Description
INLINE_CODE_67	IPv4 address records
INLINE_CODE_68	IPv6 address records
INLINE_CODE_69	Canonical name records
INLINE_CODE_70	Name server records
INLINE_CODE_71	Text records
INLINE_CODE_72	Mail exchange records
INLINE_CODE_73	Start of authority records
INLINE_CODE_74	Pointer records

Resources

• [Documentación Oficial](URL_75__
• [Repositorio GitHub](URL_76__
• [Discord de descubrimiento del producto](URL_77_

-...

*Esta hoja de trampolín proporciona una referencia completa para el uso de DNSx, desde las consultas básicas DNS hasta el filtrado avanzado e integración con otras herramientas. Para la información más actualizada, consulte siempre la documentación oficial. *