mandatoryprogrammer/northkoreadnsleak

Snapshot of North Korea's DNS data taken from zone transfers.

"What can I do for you?"

---

SELECT A CHOICE
Self-hosted XSS Hunter (Express) Tool for finding blind XSS, set up in five minutes!
CursedChrome Man-in-the-browser extension/implant
JudasDNS Nameserver DNS poisoning attacks made easy
North Korean DNS Leak (.kp) Snapshot of North Korea's DNS data taken from zone transfers
tarnish A Chrome extension static analysis tool to help aide in security reviews
TLDR A continually updated DNS archive of TLD AXFRs
cloudflare_enum Cloudflare DNS Enumeration Tool
TrustTrees A Tool for DNS Delegation Trust Graphing
xssless An automated XSS payload generator written in python.
ChromeGalvanizer Harden your Chrome browser via enterprise policy
xsshunter_client Correlated injection proxy tool for XSS Hunter
RussiaDNSLeak Summary and archives of leaked Russian TLD DNS data
droidbrute Statistically optimized USB rubber ducky payload to brute force 4-digit Android PINs
FlashHTTPRequest A very simple bridge for performing Flash HTTP requests with JavaScript
xcname A tool for enumerating expired domains in CNAME records
VietnamDNSLeak Summary and archives of leaked Vietnam TLD DNS data
comfortably-run Inject JavaScript into arbitrary Chrome origins via the Chrome DevTools Protocol

northkoreadnsleak's Issues

Timezone in README is still wrong

See #2

September 19, 2016 was in Pacific Daylight Time (PDT), not Pacific Standard Time (PST) as indicated.

Yet another reason we need to kill daylight savings time.

UTC instead of PDT or whatever..?

Us folks from the rest of the world aren't to familiar with other timezones however to make life easier you could use UTC (as everyone should know their relevancy to UTC), a quick google says PDT is UTC-7, not too sure though.

Execution poll

In which way the author of the misconfiguration will be executed?

I suggest:

• flamethrower
• mini nuclear bomb
• anti-aircraft gun
• pocket-size H-bomb
• scaphism

TL;DR vs TLDR?

I noticed this README references the TLD Records Archive as TL;DR but the projects README says TLDR with no semi-colon. Was this intentional or was this a typo?

Can I prevent this scan?

Other such DNS scanning services provide an opt-out.
Does this have such a "feature"

To be honest, other than "mildly interesting" what good is this continual scan and zone transfer request of every NS?

Is this definitely a leak?

Can you provide the rationale for this being a leak rather than a deliberate move to make these sites globally public?

zone file incomplete or already outdated?

For example the domain gnu.rep.kp. doesn't have any A records listed in this project, but there currently are some. Were these recently added or are they just missing in the repo?

$ dig ANY gnu.rep.kp +trace

[snip]

gnu.rep.kp.         43200   IN      SOA     ns1.gnu.rep.kp. postmaster.gnu.rep.kp. 2012110810 28800 7200 1209600 3600
gnu.rep.kp.         43200   IN      NS      ns2.gnu.rep.kp.
gnu.rep.kp.         43200   IN      NS      ns1.gnu.rep.kp.
gnu.rep.kp.         43200   IN      A       175.45.176.83
gnu.rep.kp.         43200   IN      A       175.45.176.73
;; Received 175 bytes from 175.45.176.9#53(175.45.176.9) in 307 ms

Timezone in README?

On Sept 20, 2016 at approximately 10:00PM

This threw me off when I saw it, because it's currently 11:55 EDT (15:55 UTC) when I read this. Maybe include a timezone? :-)

README.MD seems to be from the future.

On the README it says: On Sept 20, 2016 at approximately 10:00PM (PST),
At time of writing that event will be in ~12 hours. Did this happen last night, the 19th?