DNSx DNS Toolkit Folha de Dicas

Visão Geral

DNSx é um toolkit DNS rápido e multiuso desenvolvido pelo Project Discovery que permite executar múltiplas sondagens de DNS usando a biblioteca retryabledns. É projetado para realizar várias consultas de DNS com foco em velocidade e confiabilidade. DNSx pode lidar com múltiplos tipos de registros DNS e suporta resolvedores personalizados, tornando-o uma ferramenta versátil para reconhecimento e enumeração de DNS.

O que diferencia o DNSx de outras ferramentas DNS é sua capacidade de processar grandes números de domínios de forma eficiente e suas capacidades de integração com outras ferramentas de segurança. Ele pode filtrar registros DNS wildcard, realizar DNS walking e extrair informações valiosas das respostas DNS. DNSx é comumente usado na fase de reconhecimento de avaliações de segurança para coletar informações sobre domínios-alvo e sua infraestrutura.

DNSx suporta vários formatos de entrada e pode ser facilmente integrado com outras ferramentas em um pipeline, tornando-o um componente essencial em muitos fluxos de trabalho de teste de segurança. Sua capacidade de filtrar resultados com base em vários critérios ajuda profissionais de segurança a se concentrarem nos alvos mais relevantes.

Instalação

Usando Go

Would you like me to continue with the remaining sections?```bash

Install using Go (requires Go 1.20 or later)

go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

Verify installation

dnsx -version


### Using Docker

```bash
# Pull the latest Docker image
docker pull projectdiscovery/dnsx:latest

# Run DNSx using Docker
docker run -it projectdiscovery/dnsx:latest -h

Using Homebrew (macOS)

# Install using Homebrew
brew install dnsx

# Verify installation
dnsx -version

Using PDTM (Project Discovery Tools Manager)

# Install PDTM first if not already installed
go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest

# Install DNSx using PDTM
pdtm -i dnsx

# Verify installation
dnsx -version

On Kali Linux

# Install using apt
sudo apt install dnsx

# Verify installation
dnsx -version

Basic Usage

DNS Lookups

# Perform A record lookup for a single domain
dnsx -d example.com -a

# Perform A record lookup for multiple domains
dnsx -d example.com,hackerone.com -a

# Perform A record lookup from a list of domains
dnsx -l domains.txt -a

# Perform A record lookup from STDIN
cat domains.txt|dnsx -a

Record Types

# Query A records (IPv4 addresses)
dnsx -l domains.txt -a

# Query AAAA records (IPv6 addresses)
dnsx -l domains.txt -aaaa

# Query CNAME records (Canonical names)
dnsx -l domains.txt -cname

# Query NS records (Name servers)
dnsx -l domains.txt -ns

# Query TXT records (Text records)
dnsx -l domains.txt -txt

# Query MX records (Mail exchange servers)
dnsx -l domains.txt -mx

# Query SOA records (Start of authority)
dnsx -l domains.txt -soa

# Query PTR records (Pointer records)
dnsx -l domains.txt -ptr

# Query multiple record types
dnsx -l domains.txt -a -cname -ns

Output Options

# Save results to a file
dnsx -l domains.txt -a -o results.txt

# Output in JSON format
dnsx -l domains.txt -a -json -o results.json

# Output in CSV format
dnsx -l domains.txt -a -csv -o results.csv

# Silent mode (only results)
dnsx -l domains.txt -a -silent

Advanced Usage

Resolver Configuration

# Use specific DNS resolvers
dnsx -l domains.txt -a -resolver 1.1.1.1,8.8.8.8

# Use resolvers from a file
dnsx -l domains.txt -a -resolver-file resolvers.txt

# Use system resolvers
dnsx -l domains.txt -a -system-resolver

Response Filtering

# Filter by response containing specific string
dnsx -l domains.txt -a -resp-only -resp "1.2.3.4"

# Filter by response matching regex
dnsx -l domains.txt -a -resp-only -resp-regex "^1\.2\.[0-9]+\.[0-9]+$"

Wildcard Filtering

# Enable wildcard filtering
dnsx -l domains.txt -a -wildcard

# Set wildcard threshold
dnsx -l domains.txt -a -wildcard-threshold 5

DNS Walking

# Enable DNS walking
dnsx -l domains.txt -a -walk

# Set DNS walking threads
dnsx -l domains.txt -a -walk -walk-threads 20

Performance Optimization

Concurrency and Rate Limiting

# Set concurrency (default: 100)
dnsx -l domains.txt -a -c 200

# Set rate limit
dnsx -l domains.txt -a -rate-limit 100

# Set retries
dnsx -l domains.txt -a -retries 3

Timeout Options

# Set timeout for DNS queries (milliseconds)
dnsx -l domains.txt -a -timeout 5000

Optimization for Large Scans

# Use stream mode for large inputs
dnsx -l large-domains.txt -a -stream

# Increase concurrency for faster scanning
dnsx -l domains.txt -a -c 500

Integration with Other Tools

Pipeline with Subfinder

# Find subdomains and resolve them
subfinder -d example.com -silent|dnsx -a -silent

# Find subdomains and check for specific record types
subfinder -d example.com -silent|dnsx -a -cname -silent

Pipeline with HTTPX

# Resolve domains and probe for HTTP services
dnsx -l domains.txt -a -silent|httpx -silent

# Resolve domains, filter by IP, and probe for HTTP services
dnsx -l domains.txt -a -silent -resp "1.2.3.4"|httpx -silent

Pipeline with Naabu

# Resolve domains and scan for open ports
dnsx -l domains.txt -a -silent|naabu -silent

# Resolve domains, filter by IP, and scan for open ports
dnsx -l domains.txt -a -silent -resp "1.2.3.4"|naabu -silent

Output Customization

Custom Output Format

# Output only domain and IP
dnsx -l domains.txt -a -resp-only

# Output with additional information
dnsx -l domains.txt -a -json

# Count unique IPs
dnsx -l domains.txt -a -resp-only|sort -u|wc -l

# Sort output by IP
dnsx -l domains.txt -a -resp-only|sort -t ' ' -k2

Filtering Output

# Filter by IP
dnsx -l domains.txt -a -resp-only|grep "1.2.3.4"

# Filter by domain
dnsx -l domains.txt -a -resp-only|grep "example.com"

# Find unique IPs
dnsx -l domains.txt -a -resp-only|awk '\\\\{print $2\\\\}'|sort -u

Advanced Filtering

IP Filtering

# Filter by specific IP
dnsx -l domains.txt -a -resp-only -resp "1.2.3.4"

# Filter by IP range
dnsx -l domains.txt -a -resp-only -resp-regex "^1\.2\.3\.[0-9]+$"

Domain Filtering

# Filter by domain pattern
dnsx -l domains.txt -a -resp-only|grep "api"

# Filter by specific TLD
dnsx -l domains.txt -a -resp-only|grep "\.com$"

CNAME Filtering

# Find domains with specific CNAME
dnsx -l domains.txt -cname -resp-only -resp "cdn.example.com"

# Find domains with CNAME pointing to specific services
dnsx -l domains.txt -cname -resp-only -resp-regex "amazonaws\.com$"

Miscellaneous Features

Reverse DNS Lookup

# Perform reverse DNS lookup
dnsx -l ips.txt -ptr

# Perform reverse DNS lookup with response filtering
dnsx -l ips.txt -ptr -resp-only -resp "example.com"

DNS Trace

# Perform DNS trace
dnsx -d example.com -trace

# Perform DNS trace with specific resolver
dnsx -d example.com -trace -resolver 1.1.1.1

Health Check

# Check resolver health
dnsx -hc -resolver 1.1.1.1,8.8.8.8

# Check resolver health with timeout
dnsx -hc -resolver 1.1.1.1,8.8.8.8 -timeout 5000

Troubleshooting

Common Issues

Resolver Issues

# Try different resolvers
dnsx -l domains.txt -a -resolver 1.1.1.1,8.8.8.8

# Check resolver health
dnsx -hc -resolver 1.1.1.1,8.8.8.8

Timeout Issues

# Increase timeout
dnsx -l domains.txt -a -timeout 10000

# Increase retries
dnsx -l domains.txt -a -retries 5

Rate Limiting

# Reduce concurrency
dnsx -l domains.txt -a -c 50

# Set rate limit
dnsx -l domains.txt -a -rate-limit 50

Memory Issues

# Use stream mode for large inputs
dnsx -l large-domains.txt -a -stream

Debugging

# Enable verbose mode
dnsx -l domains.txt -a -v

# Show debug information
dnsx -l domains.txt -a -debug

# Show statistics
dnsx -l domains.txt -a -stats

Configuration

Configuration File

DNSx uses a configuration file located at $HOME/.config/dnsx/config.yaml. You can customize various settings in this file:

# Example configuration file
concurrency: 100
rate-limit: 100
retries: 3
timeout: 5000
resolvers:
  - 1.1.1.1
  - 8.8.8.8

Environment Variables

# Set DNSx configuration via environment variables
export DNSX_CONCURRENCY=100
export DNSX_RATE_LIMIT=100
export DNSX_RETRIES=3
export DNSX_TIMEOUT=5000
export DNSX_RESOLVERS=1.1.1.1,8.8.8.8

Reference

Command Line Options

Bandeira	Descrição
`-d, -domain`	Domínio de destino para consulta
`-l, -list`	Ficheiro contendo lista de domínios para consulta
`-a`	Consultar registros A
`-aaaa`	Consultar registros AAAA
`-cname`	Consultar registros CNAME
`-ns`	Consultar registros NS
`-txt`	Consultar registros TXT
`-mx`	Consultar registros MX
`-soa`	Consultar registros SOA
`-ptr`	Consultar registros PTR
`-o, -output`	Arquivo para gravar saída em
`-json`	Escreva a saída em formato JSON
`-csv`	Escrever saída em formato CSV
`-silent`	Mostrar apenas resultados na saída
`-v, -verbose`	Mostrar saída detalhada
`-resolver`	Resolvedores DNS para usar
`-resolver-file`	Arquivo contendo resolvedores DNS
`-system-resolver`	Utilize resolvedores de sistema
`-resp-only`	Mostrar apenas resposta na saída
`-resp`	Filtrar resposta contendo string
`-resp-regex`	Filtrar resposta correspondente a regex
`-wildcard`	Ativar filtragem com caractere curinga
`-wildcard-threshold`	Limite de filtragem de wildcard
`-walk`	Ativar DNS walking
`-walk-threads`	Número de threads de caminhada DNS
`-c, -concurrency`	Número de consultas simultâneas
`-rate-limit`	Número máximo de consultas por segundo
`-retries`	Número de tentativas para consultas com falha
`-timeout`	Tempo limite para consultas DNS em milissegundos
`-stream`	Modo de stream para entradas grandes
`-hc`	Verificar saúde do resolver
`-trace`	Realizar rastreamento DNS
`-version`	Mostrar versão do DNSx

Record Types

Tipo	Descrição
`A`	Registros de endereço IPv4
`AAAA`	Registros de endereço IPv6
`CNAME`	Registros de nome canônico
`NS`	Registros de servidor de nomes
`TXT`	Registros de texto
`MX`	Registros de troca de e-mail
`SOA`	Início dos registros de autoridade
`PTR`	Registros Pointer

Resources

This cheat sheet provides a comprehensive reference for using DNSx, from basic DNS queries to advanced filtering and integration with other tools. For the most up-to-date information, always refer to the official documentation.