Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/anshumanbh/tko-subs

A tool that can help detect and takeover subdomains with dead DNS records
https://github.com/anshumanbh/tko-subs

Last synced: about 1 month ago
JSON representation

A tool that can help detect and takeover subdomains with dead DNS records

Awesome Lists containing this project

README 

        
# tko-subs



This tool allows:

* To check whether a subdomain can be taken over because it has:

	* a dangling CNAME pointing to a CMS provider (Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc.) that can be taken over.

	* a dangling CNAME pointing to a non-existent domain name

	* one or more wrong/typoed NS records pointing to a nameserver that can be taken over by an attacker to gain control of the subdomain's DNS records



* To actually take over those subdomain by providing a flag `-takeover`. Currently, take over is only supported for Github Pages and Heroku Apps and by default the take over functionality is off.



* To specify your own CMS providers and check for them via the [providers-data.csv](providers-data.csv) file. In that file, you would mention the CMS name, their CNAME value, their string that you want to look for and whether it only works over HTTP or not. Check it out for some examples.



### Disclaimer: DONT BE A JERK!



Needless to mention, please use this tool very very carefully. The authors won't be responsible for any consequences.

By default, this tool does not allow taking over of subdomains. If you want to do it, just specify the `-takeover` flag.



### Pre-requisites



We need GO installed. Once you have GO, just type `go get github.com/anshumanbh/tko-subs` to download the tool.



Once the tool is downloaded, type `tko-subs -h`.



The next thing we need to do is to get the following information:

* Github's Personal Access Token - Make sure this token has the rights to create repositories, references, contents, etc. You can create this token here - https://github.com/settings/tokens

* Heroku Username and API key

* Heroku app name - You can create a static app on Heroku with whatever you want to be displayed on its homepage by following the instructions here - https://gist.github.com/wh1tney/2ad13aa5fbdd83f6a489. Once you create that app, use that app name in the flag (see below). We will use that app to takeover the domain (with the dangling CNAME to another Heroku app).



NOTE - You only need these values if you want to take over subdomains. By default, that's not required.



Required Go Packages to build.



```

go get github.com/bgentry/heroku-go

go get github.com/gocarina/gocsv

go get github.com/google/go-github/github

go get github.com/olekukonko/tablewriter

go get golang.org/x/net/publicsuffix

go get golang.org/x/oauth2

go get github.com/miekg/dns

```



### How to run?



Once you have everything installed, `cd` into the directory and type:

`tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv`



If you want to take over as well, the command would be:

`tko-subs -domains=domains.txt -data=providers-data.csv -output=output.csv -takeover -githubtoken= -herokuusername= -herokuapikey= -herokuappname=`



If you just want to check for a single domain, type:

`tko-subs -domain `



If you just want to check for multiple domains, type:

`tko-subs -domain ,`



By default:

* the `domains` flag is set to `domains.txt`

* the `data` flag is set to `providers-data.csv`

* the `output` flag is set to `output.csv`

* the `takeover` flag is not set so no take over by default

* the `domain` flag is NOT set so it will always check for all the domains mentioned in the `domains.txt` file. If the `domain` flag is mentioned, it will only check that domain and ignore the `domains.txt` file, even if present

* the `threads` flag is set to `5`



So, simply running `tko-subs` would run with the default values mentioned above.



### How is providers-data.csv formatted?



name,cname,string,http



* name: The name of the provider (e.g. github)

* cname: The CNAME used to map a website to the provider's content (e.g. github.io)

* string: The error message returned for an unclaimed subdomain (e.g. "There isn't a GitHub Pages site here")

* http: Whether to use http (not https, which is the default) to connect to the site (true/false)



### How is the output formatted?



Domain,CNAME,Provider,IsVulnerable,IsTakenOver,Response



* Domain: The domain checked

* CNAME: The CNAME of the domain

* Provider: The provider the domain was found to be using

* IsVulnerable: Whether the domain was found to be vulnerable or not (true/false)

* IsTakenOver: Whether the domain was taken over or not (true/false)

* Response: The message that the subdomain was checked against



If a dead DNS record is found, `Provider` is left empty.

If a misbehaving nameserver is found, `Provider` and `CNAME` are left empty



### What is going on under the hood?



This will iterate over all the domains (concurrently using GoRoutines) in the `subdomains.txt` file and:

* See if they have a misbehaving authoritative nameserver; if they do, we mark that domain as vulnerable.

* See if they have dangling CNAME records aka dead DNS records; if they do we mark that domain as vulnerable.

* If a subdomain passes these two tests, it tries to curl them and get back a response and then try to see if that response matches any of the data provider strings mentioned in the [providers-data.csv](providers-data.csv) file.

* If the response matches, we mark that domain as vulnerable.

* Next, depending upon whether the `takeover` flag is mentioned or not, it will try to take over that vulnerable subdomain.

* For example, to takeover a Github Page, the code will:

	* Create a repo

	* Create a branch `gh-pages` in that repo

	* Upload `CNAME` and `index.html` to the `gh-pages` branch in that repo. Here, `CNAME` contains the domain that needs to be taken over. `index.html` contains the text `This domain is temporarily suspended` that is to be displayed once the domain is taken over.

* Similarly, for Heroku apps, the code will:

	* Add the dangling domain to your Heroku app (whose name you will be providing in the .env file)

* And, that's it!



### Future Work



* ~Take CMS name and regex from user or .env file and then automatically hook them into the tool to be able to find it.~ DONE

* Add takeovers for more CMS

* Add more CMS providers



### Credits



* Thanks to Luke Young (@TheBoredEng) for helping me out with the go-github library.

* Thanks to Frans Rosen (@fransrosen) for helping me understand the technical details that are required for some of the takeovers.

* Thanks to Mohammed Diaa (@mhmdiaa) for taking time to implement the provider data functionality and getting the code going.

* Thanks to high-stakes for a much needed code refresh.



### Changelog



`5/27`

* Added new Dockerfile reducing the size of the image

* Added sample domains.txt file to test against

* mhmdiaa added the logic for dead DNS takeovers. Updated documentation. Thanks a lot!



`11/6`

* high-stakes issues a PR with a bunch of new code that fixes a few bugs and makes the code cleaner



`9/22`

* Added an optional flag to check for single domain

* Made it easier to install and run



`6/25`

* Made the code much more faster by implementing goroutines

* Instead of checking using Golang's net packages' LookupCNAME function, made it to just use dig since that gives you dead DNS records as well. More attack surface!!