puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.
It uses massdns, a powerful stub DNS resolver, to perform bulk lookups. With the proper bandwidth and a good list of public resolvers, it can resolve millions of queries in just a few minutes. Unfortunately, the results from massdns are only as good as the answers provided by the public resolvers. The results are often polluted by wrong DNS answers and false positives from wildcard subdomains.
puredns solves this with its wildcard detection algorithm. It can filter out wildcards based on the DNS answers obtained from a set of trusted resolvers. It also attempts to work around DNS poisoning by validating the answers obtained using those trusted resolvers.
Features
- Resolve thousands of DNS queries per second using massdns and a list of public DNS resolvers
- Bruteforce subdomains using a wordlist and a root domain
- Clean wildcards and detect wildcard roots using the minimal number of queries to ensure precise results
- Circumvent DNS load-balancing during wildcard detection
- Validate that the results are free of DNS poisoning by running against a list of known, trusted resolvers
- Save a list of valid domains, wildcard subdomain roots, and a clean massdns output containing only the valid entries
- Read a list of domains or words from stdin and enable quiet mode for easy integration into custom automation pipelines
Getting Started
Prerequisites
massdns
Puredns requires massdns on the host machine. If the path to the massdns binary is present in the PATH environment variable, puredns will work out of the box. A good place to copy the massdns executable is /usr/local/bin on most systems. Otherwise, you will need to specify the path to the massdns binary file using the --bin command-line argument.
The following should work on most Debian based systems. Follow the official instructions for more information.
git clone https://github.com/blechschmidt/massdns.git
cd massdns
make
sudo make install
go 1.15+
The last two major releases of Go are supported. Note that go 1.16 is recommended.
Refer to the official Go installation page for installation instructions.
List of public DNS resolver servers
You need to obtain a list of public DNS servers in order to use puredns. Refer to the FAQ to learn how to curate your own list of working servers.
Installation
You can install puredns using the following command:
GO111MODULE=on go get github.com/d3mondev/puredns/v2
Usage
Make sure to view the complete list of available commands and options using puredns --help.
If a resolvers.txt file is present in the current working directory, puredns will automatically use it as a list of public resolvers. Otherwise, specify the list of resolvers to use using the -r argument.
Subdomain bruteforcing
Here’s how to bruteforce a massive list of subdomains using a wordlist named all.txt:
puredns bruteforce all.txt domain.com
Resolving a list of domains
You can also resolve a list of domains contained in a text file (one per line).
puredns resolve domains.txt
Stdin operation
You can pass the list of domains to resolve through stdin:
cat domains.txt | puredns resolve
Or a list of words to use for bruteforcing:
cat wordlist.txt | puredns bruteforce domain.com
You can also add the -q switch to output only the domains found to pipe to other tools:
cat domains.txt | puredns resolve -q | httprobe
Saving the results to files
You can save the following information to files to reuse it in your workflows:
- domains: clean list of domains that resolve correctly
- wildcard root domains: list of the wildcard root domains found (i.e., *.store.yahoo.com)
- massdns results file (-o Snl text output): can be used as a reference and to extract A and CNAME records.
puredns resolve domains.txt --write valid_domains.txt \
--write-wildcards wildcards.txt \
--write-massdns massdns.txt
How it works
You can see puredns in action against the domain google.com using a small wordlist of the 100k most common subdomains in the image above.
As part of its workflow, puredns performs three steps automatically:
- Mass resolve using public DNS servers
- Wildcard detection
- Validation
1. Mass resolve using public DNS servers
Using massdns, puredns will perform a mass resolve of all the domains and subdomains. It feeds the data to massdns through stdin, which allows it to throttle the number of queries per second if needed and perform basic sanitization on the list of domains generated.
By default, the input domains are set to lowercase, and only entries containing valid characters are accepted (essentially [a-z0-9.-]). You can disable this with the --skip-sanitize flag.
After this step, the results are usually polluted: some public resolvers will send back bad answers, and wildcard subdomains can quickly inflate the results.
2. Wildcard detection
Puredns then uses its wildcard detection algorithm to detect and extract all the wildcard subdomain roots from the massdns results file.
It will use the massdns output from step 1 as a DNS cache to minimize the number of queries it needs to perform. To ensure precise results, it may have to validate the cache results by performing a DNS query.
You can skip this step using the --skip-wildcard flag.
3. Validation
To protect against DNS poisoning, puredns uses massdns one last time to validate the remaining results using an internal list of trusted DNS resolvers. Currently, the trusted resolvers used are 8.8.8.8 and 8.8.4.4. This step is done at a slower pace to avoid hitting any rate limiting on the trusted resolvers.
You can skip this step using the --skip-validation flag.
At this point, the resulting files should be clean of wildcard subdomains and DNS poisoned answers.
Download: https://github.com/d3mondev/puredns
