Tuesday, April 8, 2014

Mèdved - web-based dns zone transfer automation

Entry moved here: http://wondershell.wordpress.com/2014/04/09/medved-web-based-dns-zone-transfer-automation/



It's been a while since my last post, so today i have something bigger and - most probably - more usefull than usually. [Download link on the bottom]

I present to you Mèdved (name means bear in serbian language). It is a part of the suite of tools i'm creating thus the main directory is named carnivores.
This is a web-based tool designed to automate the search for domain transfers. It has an intuitive interface and few helpful shortcuts. As an input it expects a domain or list of domains. Ideally the list should be comma-separated but it will handle space or CR-LF separated lists as well. Aside from normal results it gives you a log of performed searches and all successful transfers are archived.

Requirements:
Linux + Apache2
path to medved.php: /var/www/carnivores/medved/medved.php (simply extract the archive to /var/www/)

There are some requirements for directory structure and permissions so i show you how the tree should look like:





Below is the first page with help toggled.




It has been implemented with responsive design so you can use it on your smartphone/tablet although the interface becomes slightly denser:




You can supply the list as domain.com, domain2.com, domain3.com.
If you have a list looking like this: domain.com domain2.com domain3.com
or like this:

domain.com 
domain2.com 
domain3.com

you can paste it as well, just use the button Spaces to commas, before clicking Analyze button, and the list will be corrected to expected form. If you have an URL list instead of domains - use the button Sanitize URLs and it should strip all the unnecessary stuff from the URL. 

This and more about the available functions and shortcuts is described in the help.

Lets see how it works with example:




As you can see the transfer for Microsoft is actively refused. All tested NS servers have separate tabs. The warning sign shown for other domain (which i removed from the picture) indicates that server do not accept TCP connections. The OK sign for one of the servers indicates successful transfer.

It is common to frequently test the same domain after some time, to see if new records have been added or if the server configuration has been corrected. That is why all the successful transfers are saved in the archive. An archive is a simple list of available transfer results. 






You can filter the results to show the particular domain only, by clicking on a domain name. The list shows the date of the transfer, records discovered and the link to review the transfer data. If more than one server responded with transfer data for particular domain, the number of records shown will be the sum from all the servers.
This might give you a false idea that you might get 1000 records in the transfer when in fact you received 500 records but from two servers.

If you need unique records just save the file and use the command 

cat records.txt | sort -u

I'm not going to post any code in here as it would be really tedious work. Instead you can download all of it using the link below.

Download from here.

As usual i'm not responsible for how you use this tool. This is presented only as a proof of concept. You can use it but you cannot distribute it without my knowledge and explicit consent.

I've used a code snippet from http://blog.stevenlevithan.com/archives/parseuri for URL parsing and shortcut.js file from http://www.openjs.com/scripts/events/keyboard_shortcuts/ for creating shortcuts.

No comments:

Post a Comment