https://github.com/cramppet/regulator

Automated learning of regexes for DNS discovery
https://github.com/cramppet/regulator

Last synced: about 1 month ago
JSON representation

Automated learning of regexes for DNS discovery

• Host: GitHub
• URL: https://github.com/cramppet/regulator
• Owner: cramppet
• Created: 2022-10-16T17:22:52.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2023-02-18T15:51:51.000Z (over 1 year ago)
• Last Synced: 2024-06-06T20:02:30.409Z (3 months ago)
• Language: Python
• Size: 18.6 KB
• Stars: 339
• Watchers: 5
• Forks: 43
• Open Issues: 7
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - cramppet/regulator - Automated learning of regexes for DNS discovery (Python)

README

        
# Project REGULATOR: Automated learning of regexes for DNS discovery

I had a lot of fun making this and I hope this project will change the way you

see subdomain enumeration. The method explored here is highly effective and

efficient.

With this said, it's not a silver bullet. Not every DNS zone performs well with

this method. It fails when there are no latent text structures in the hostnames

(ie. they are seemingly random) or you have limited observational data.

This project was developed primarily to showcase the power of regular language

ranking via the `dank` (https://github.com/cramppet/dank) library. I wanted to

show that the concept of ranking and using regexes as templates for fuzzing can

work very well.

For more information see the blog post here: https://cramppet.github.io/regulator/index.html

## Install

1. clone the repository

2. install the dependencies `pip3 install -r requirements.txt`

## Usage

1. Run your subdomain enumeration tool of choice

2. Supply the hostnames found to REGULATOR: `python3 main.py -t  -f  -o `

# Example

1. `python3 main.py -t adobe.com -f adobe.subs -o adobe.brute`

3. `puredns resolve adobe.brute --write adobe.valid`

Be advised that the discovered hosts will overlap with your original input data.

If you want the subdomains that were not previously found by the subdomain 

enumeration tool, use the following command: 

 

 `comm -23 <(sort -u adobe.valid) <(sort -u adobe.subs) > adobe.final`