Bypass Firewalls By DNS History
Bypass Firewalls By Abusing DNS History
Firewall bypass script based on DNS history records. This script will search for DNS A history records and check if the server replies for that domain. Handy for bugbounty hunters.This script will try to find:
- The direct IP address of a server behind a firewall like Cloudflare, Incapsula, SUCURI
- An old server which still running the same (inactive and unmaintained) website, not receiving active traffic because the A DNS record is not pointing towards it. Because it's an outdated and unmaintained website version of the current active one, it is likely vulnerable for various exploits. It might be easier to find SQL injections and access the database of the old website and abuse this information to use on the current and active website.
The script also fetches the IP's of subdomains because my own experience learned me that subdomain IP's sometimes point to the origin of the main domain.
Usage
Use the script like this-bash bypass-firewalls-by-DNS-history.sh -d example.com
-d --domain: domain to bypass
-o --outputfile: output file with IP's
-l --listsubdomains: list with subdomains for extra coverage
Requirements (optional)
jq is needed to parse output to gather automatically subdomains. Install with apt install jq.For who is this script?
This script is handy for:- Security auditors
- Web administrators
- Bug bounty hunters
- Blackhatters I guess
How to protect against this script?
If you use a firewall, make sure to accept only traffic coming through the firewall. Deny all traffic coming directly from the internet. For example: Cloudflare has a list of IP's which you can whitelist with iptables or UFW. Deny all other traffic.Make sure that no old servers are still accepting connections and not accessible in the first place
Web services used in this script
The following services are used:
- SecurityTrails
- CrimeFlare
- certspotter
- DNSDumpster
- IPinfo
FAQ
Why in Bash and not in Python?It started out as a few CURL one-liners, became a bash script, extended the code more and more, and the regret of not using Python extended accordingly.
I find more subdomains with my tools?
I know. I cannot expect everyone to install all these DNS brute-force and enumeration tools. In addition, I don't know beforehand in which folder these tools are placed or under which alias these tools are called. You can still provide your own list with -l so you can feed output of these subdomain tools into this tool. Expected input is a full subdomain on each line.
Download
from Hackers Online Club (HOC) http://bit.ly/2H6srLx
