blechschmidt/massdnsA high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per second using publicly available resolvers.
Clone the git repository and cd into the project root folder. Then run make to build from source.
If you are not on Linux, run make nolinux. On Windows, the Cygwin packages gcc-core, git and make are required.
Usage: ./bin/massdns [options] [domainlist]
-b --bindto Bind to IP address and port. (Default: 0.0.0.0:0)
--busy-poll Use busy-wait polling instead of epoll.
-c --resolve-count Number of resolves for a name before giving up. (Default: 50)
--drop-group Group to drop privileges to when running as root. (Default: nogroup)
--drop-user User to drop privileges to when running as root. (Default: nobody)
--extended-input Input names are followed by a space-separated list of resolvers.
These are used before falling back to the resolvers file.
--filter Only output packets with the specified response code.
--flush Flush the output file whenever a response was received.
-h --help Show this help.
--ignore Do not output packets with the specified response code.
-i --interval Interval in milliseconds to wait between multiple resolves of the same
domain. (Default: 500)
-l --error-log Error log file path. (Default: /dev/stderr)
--norecurse Use non-recursive queries. Useful for DNS cache snooping.
-o --output Flags for output formatting.
--predictable Use resolvers incrementally. Useful for resolver tests.
--processes Number of processes to be used for resolving. (Default: 1)
-q --quiet Quiet mode.
--rand-src-ipv6 Use a random IPv6 address from the specified subnet for each query.
--rand-src-ipv6-file Use a random IPv6 address from the specified file.
--rcvbuf Size of the receive buffer in bytes.
--retry Unacceptable DNS response codes.
(Default: All codes but NOERROR or NXDOMAIN)
-r --resolvers Text file containing DNS resolvers.
--root Do not drop privileges when running as root. Not recommended.
-s --hashmap-size Number of concurrent lookups. (Default: 10000)
--sndbuf Size of the send buffer in bytes.
--status-format Format for real-time status updates, json or ansi (Default: ansi)
--sticky Do not switch the resolver when retrying.
--socket-count Socket count per process. (Default: 1)
-t --type Record type to be resolved. (Default: A)
--verify-ip Verify IP addresses of incoming replies.
-w --outfile Write to the specified output file instead of standard output.
Output flags:
L - domain list output
S - simple text output
F - full text output
B - binary output
J - ndjson output
Advanced flags for the domain list output mode:
0 - Include NOERROR replies without answers.
Advanced flags for the simple output mode:
d - Include records from the additional section.
i - Indent any reply record.
l - Separate replies using a line feed.
m - Only output reply records that match the question name.
n - Include records from the answer section.
q - Print the question.
r - Print the question with resolver IP address, Unix timestamp and return code prepended.
s - Separate packet sections using a line feed.
t - Include TTL and record class within the output.
u - Include records from the authority section.
Advanced flags for the ndjson output mode:
e - Write a record for each terminal query failure.
For a detailed description of the command line interface, please consult the man page using man ./doc/massdns.1.
Resolve all AAAA records from domains within domains.txt using the resolvers within resolvers.txt in lists and
store the results within results.txt:
$ ./bin/massdns -r lists/resolvers.txt -t AAAA domains.txt > results.txt
This is equivalent to:
$ ./bin/massdns -r lists/resolvers.txt -t AAAA -w results.txt domains.txt
By default, MassDNS will output response packets in text format which looks similar to the following:
;; Server: 77.41.229.2:53
;; Size: 93
;; Unix time: 1513458347
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51298
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; QUESTION SECTION:
example.com. IN A
;; ANSWER SECTION:
example.com. 45929 IN A 93.184.216.34
;; AUTHORITY SECTION:
example.com. 24852 IN NS b.iana-servers.net.
example.com. 24852 IN NS a.iana-servers.net.
The resolver IP address is included in order to make it easier for you to filter the output in case you detect that some resolvers produce bad results.
The repository includes the file resolvers.txt consisting of a filtered subset of the resolvers provided by the subbrute project.
Please note that the usage of MassDNS may cause a significant load on the used resolvers and result in abuse complaints being sent to your ISP.
Also note that the provided resolvers are not guaranteed to be trustworthy. The resolver list is currently outdated with a large share of resolvers being dysfunctional.
MassDNS's custom, malloc-free DNS implementation currently only supports the most common records. You are welcome to help changing this by collaborating.
MassDNS includes a Python script allowing you to resolve all IPv4 PTR records by printing their respective queries to the standard output.
$ ./scripts/ptr.py | ./bin/massdns -r lists/resolvers.txt -t PTR -w ptr.txt
Please note that the labels within in-addr.arpa are reversed. In order to resolve the domain name of 1.2.3.4, MassDNS expects 4.3.2.1.in-addr.arpa as input query name.
As a consequence, the Python script does not resolve the records in an ascending order which is an advantage because sudden heavy spikes at the name servers of IPv4 subnets are avoided.
Perform reconnaissance scans responsibly and adjust the -s parameter to not overwhelm authoritative name servers.
Similar to subbrute, MassDNS allows you to brute force subdomains using the included subbrute.py script:
$ ./scripts/subbrute.py example.com lists/names.txt | ./bin/massdns -r lists/resolvers.txt -t A -o S -w results.txt
As an additional method of reconnaissance, the ct.py script extracts subdomains from certificate transparency logs by scraping the data from crt.sh:
$ ./scripts/ct.py example.com | ./bin/massdns -r lists/resolvers.txt -t A -o S -w results.txt
The files names.txt and names_small.txt, which have been copied from the subbrute project, contain names of commonly used subdomains. Also consider using Jason Haddix' subdomain compilation with over 1,000,000 names or the Assetnote wordlist with over 9,000,000 million names.