False positives during wildcard removal

[projectdiscovery]

False positives during wildcard removal

[adityathebe]

This is a tricky one since there's no DNS record for *.latest.facebook.com

host -t CNAME '*.latest.facebook.com'
Host *.latest.facebook.com not found: 3(NXDOMAIN)

[ehsandeep]

@adityathebe I can't repro this, do you have a list to share that you are using to resolve?

cat gg.txt 

sw-ke.latest.facebook.com
m.latest.facebook.com
pixel.latest.facebook.com
del-tec.latest.facebook.com
ms-my.latest.facebook.com
latest.facebook.com
upload.latest.facebook.com
www.latest.facebook.com
be-by.latest.facebook.com
secure.latest.facebook.com
tr-tr.latest.facebook.com
web.latest.facebook.com

> shuffledns -d facebook.com -list gg.txt -r resolvers.txt 

       __        ________        __       
  ___ / /  __ __/ _/ _/ /__  ___/ /__ ___
 (_-</ _ \/ // / _/ _/ / -_)/ _  / _ \(_-<
/___/_//_/\_,_/_//_//_/\__/ \_,_/_//_/___/ v1								

		projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Creating temporary massdns output file: /tmp/shuffledns102647888/bvk7enu7dd9tsavmnulg
[INF] Executing massdns on facebook.com
[INF] Massdns execution took 36.94979ms
[INF] Started parsing massdns output
[INF] Massdns output parsing compeleted
[INF] Started removing wildcards records
[INF] Wildcard removal completed
[INF] Finished enumeration, started writing output
secure.latest.facebook.com
[INF] Finished resolving. Hack the Planet!

[adityathebe]

I tried this with 1.1.1.1 as the only resolver and it did indeed give me valid result. It must be my resolvers list that's causing the issue

[adityathebe]

1.0.0.1
1.1.1.1
64.6.64.6
64.6.65.6
8.20.247.20
8.26.56.26
8.8.4.4
8.8.8.8
9.9.9.9
198.98.49.91
91.239.100.100
89.233.43.71

These were the resolvers I used

[ehsandeep]

@adityathebe Yes, resolvers plays the key role using massdns/shuffledns, so make sure you are using the good list in order to get the most valid results.

[adityathebe]

Hey @bauthard,

I think there's a bigger issue here. When I only use a single resolver everything's fine. However things are a bit different when multiple resolvers are used (which is always the case)

Take a look at these results

❯ dig +short 'totallyfakedomain.latest.facebook.com' @8.8.4.4 
157.240.16.9

❯ dig +short 'totallyfakedomain.latest.facebook.com' @1.1.1.1  
157.240.1.9

8.8.4.4(Google) and 1.1.1.1(CloudFlare) are extremely reliable resolvers. I'm guessing ms-my.latest.facebook.com is under a load balancer which is why they have different A records for the two different DNS resolvers.

If I try it with ClouDNS I get another different A record

dig +short 'totallyfakedomain.latest.facebook.com' @85.159.233.158
185.105.33.106

ShuffleDNS fails to recognize that multiple non existent wildcard domains point to different addresses since it essentially looks at how many domains are pointing to the IP address.

As for your test before how many resolvers did you use?