lock up when expanding IP ranges

[darkoperator]

lock up when expanding IP ranges

[darkoperator]

How large of a range? When expanding there will be no traffic because well it is expanding the range to then scan. The size of the range will have a CPU and memory impact. If IPv6 ranges are present do not do expansion since it will be there for a long time and suck a lot of memory

…

Sent from my iPhone

On Mar 6, 2017, at 6:03 AM, Robin Wood ***@***.***> wrote: Running with these parameters: -t std,axfr,brt -D ~/dns2.txt -d abc.org.uk --csv abc-dns-enum.csv I get as far as [*] Expanding IP ranges found in DNS and TXT records for Reverse Look-up and the it locks up. I've checked with tcpdump and no more traffic is sent out and I've left it for 5 minutes and nothing happened. It is a very small and basic domain, two TXT records, one pointing at outlook.com and one just text. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[digininja]

I've got all the data, what entries am I looking for? As their mail is with Outlook it may be that. It stalled on their second domain as well.

…

On Mon, 6 Mar 2017 at 10:52 Carlos Perez ***@***.***> wrote: How large of a range? When expanding there will be no traffic because well it is expanding the range to then scan. The size of the range will have a CPU and memory impact. If IPv6 ranges are present do not do expansion since it will be there for a long time and suck a lot of memory Sent from my iPhone > On Mar 6, 2017, at 6:03 AM, Robin Wood ***@***.***> wrote: > > Running with these parameters: > > -t std,axfr,brt -D ~/dns2.txt -d abc.org.uk --csv abc-dns-enum.csv > I get as far as > > [*] Expanding IP ranges found in DNS and TXT records for Reverse Look-up > and the it locks up. I've checked with tcpdump and no more traffic is sent out and I've left it for 5 minutes and nothing happened. It is a very small and basic domain, two TXT records, one pointing at outlook.com and one just text. > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub, or mute the thread. > — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#65 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAHJWSr6kz3RRlEy3mT98kj90treodhkks5ri-VWgaJpZM4MT8R6> .

[darkoperator]

Look at what ranges are advertised in their SPF and TXT records

…

Sent from my iPhone

On Mar 6, 2017, at 6:55 AM, Robin Wood ***@***.***> wrote: I've got all the data, what entries am I looking for? As their mail is with Outlook it may be that. It stalled on their second domain as well. On Mon, 6 Mar 2017 at 10:52 Carlos Perez ***@***.***> wrote: > How large of a range? When expanding there will be no traffic because well > it is expanding the range to then scan. The size of the range will have a > CPU and memory impact. If IPv6 ranges are present do not do expansion since > it will be there for a long time and suck a lot of memory > > Sent from my iPhone > > > On Mar 6, 2017, at 6:03 AM, Robin Wood ***@***.***> wrote: > > > > Running with these parameters: > > > > -t std,axfr,brt -D ~/dns2.txt -d abc.org.uk --csv abc-dns-enum.csv > > I get as far as > > > > [*] Expanding IP ranges found in DNS and TXT records for Reverse Look-up > > and the it locks up. I've checked with tcpdump and no more traffic is > sent out and I've left it for 5 minutes and nothing happened. It is a very > small and basic domain, two TXT records, one pointing at outlook.com and > one just text. > > > > — > > You are receiving this because you are subscribed to this thread. > > Reply to this email directly, view it on GitHub, or mute the thread. > > > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#65 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAHJWSr6kz3RRlEy3mT98kj90treodhkks5ri-VWgaJpZM4MT8R6> > . > — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[digininja]

Here you go: ``` [*] TXT xxx.org.uk v=spf1 a mx ptr mx:mx1.xxx.org.uk mx:mx2.xxx.org.uk mx:mail.xxx.org.uk mx:xxx.org.uk mx:exchange.xxx.org.uk include: spf.protection.outlook.com -all ```

…

On Mon, 6 Mar 2017 at 10:58 Carlos Perez ***@***.***> wrote: Look at what ranges are advertised in their SPF and TXT records Sent from my iPhone > On Mar 6, 2017, at 6:55 AM, Robin Wood ***@***.***> wrote: > > I've got all the data, what entries am I looking for? As their mail is with > Outlook it may be that. It stalled on their second domain as well. > > On Mon, 6 Mar 2017 at 10:52 Carlos Perez ***@***.***> wrote: > > > How large of a range? When expanding there will be no traffic because well > > it is expanding the range to then scan. The size of the range will have a > > CPU and memory impact. If IPv6 ranges are present do not do expansion since > > it will be there for a long time and suck a lot of memory > > > > Sent from my iPhone > > > > > On Mar 6, 2017, at 6:03 AM, Robin Wood ***@***.***> wrote: > > > > > > Running with these parameters: > > > > > > -t std,axfr,brt -D ~/dns2.txt -d abc.org.uk --csv abc-dns-enum.csv > > > I get as far as > > > > > > [*] Expanding IP ranges found in DNS and TXT records for Reverse Look-up > > > and the it locks up. I've checked with tcpdump and no more traffic is > > sent out and I've left it for 5 minutes and nothing happened. It is a very > > small and basic domain, two TXT records, one pointing at outlook.com and > > one just text. > > > > > > — > > > You are receiving this because you are subscribed to this thread. > > > Reply to this email directly, view it on GitHub, or mute the thread. > > > > > > > — > > You are receiving this because you authored the thread. > > Reply to this email directly, view it on GitHub > > < #65 (comment) >, > > or mute the thread > > < https://github.com/notifications/unsubscribe-auth/AAHJWSr6kz3RRlEy3mT98kj90treodhkks5ri-VWgaJpZM4MT8R6 > > > . > > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub, or mute the thread. > — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#65 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAHJWbg7oYN-Juk87cTPFi81mh2LZk3kks5ri-bUgaJpZM4MT8R6> .

[darkoperator]

not so much of a lockup but that the ranges in the include are huge and it is taking a loooooong time to expand the ranges

infidel01:dnsrecon carlos$ nslookup -q=txt spf.protection.outlook.com
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:
spf.protection.outlook.com	text = "v=spf1 ip4:207.46.101.128/26 ip4:207.46.100.0/24 ip4:207.46.163.0/24 ip4:65.55.169.0/24 ip4:157.56.110.0/23 ip4:157.55.234.0/24 ip4:213.199.154.0/24 ip4:213.199.180.0/24 include:spfa.protection.outlook.com -all"

Authoritative answers can be found from:

infidel01:dnsrecon carlos$ nslookup -q=txt spfa.protection.outlook.com
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:
spfa.protection.outlook.com	text = "v=spf1 ip4:157.56.112.0/24 ip4:207.46.51.64/26 ip4:157.55.158.0/23 ip4:64.4.22.64/26 ip4:40.92.0.0/14 ip4:40.107.0.0/17 ip4:40.107.128.0/18 ip4:134.170.140.0/24 include:spfb.protection.outlook.com -all"

Authoritative answers can be found from:

SPF expansion and Google should not run by default and neither in std, seems after changing arg parsing lib it checks for None instead of a boolean. Will modify so it checks properly for a boolean.

[digininja]

Great, thanks