CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-10-21 19:32:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

zoneTrans.nse now takes a "domain" script argument to specify the domain name

Browse source 
to transfer.  I've only been able to examine the behavior through Wireshark
since I don't have a nameserver that transfers other domains (I always get
"Not Authoritative").  It seems to work fine, though
This commit is contained in:
kris 2008-06-05 04:22:27 +00:00
parent c23be3a67c
commit 3512576c9b
2 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGELOG
View file

@ -11,6 +11,10 @@ o Nmap now returns correct values for --iflist in windows even
o Nmap no longer crashes with an 'assert' error when its told to
access a disabled wifi NIC on some laptops. [Michael]
o The zoneTrans.nse script now takes a "domain" script argument to
specify the desired domain name to transfer. You can narrow the
scope down with the form "zoneTrans={domain=xxx}". [Kris]
Nmap 4.65 [2008-6-1]
o A Mac OS X Nmap/Zenmap installer is now available from the Nmap

30
scripts/zoneTrans.nse
View file

@ -1,9 +1,10 @@
--[[
Send axfr queries to DNS servers. The domain to query is determined
by examining the domain servers hostname. If the query is successful
all domains and domain types are returned along with common type
specific data (SOA/MX/NS/PTR/A)
by examining the name given on the command line, the domain servers
hostname, or it can be specified with the "domain" script argument.
If the query is successful all domains and domain types are returned
along with common type specific data (SOA/MX/NS/PTR/A)
constraints
-----------
@ -263,17 +264,32 @@ action = function(host, port)
local catch = function() soc:close() end
local try = nmap.new_try(catch)
-- can't do anything without a hostname
if host.name == "" then return nil end
local domain = nil
local args = nmap.registry.args
if args.zoneTrans and args.zoneTrans.domain then
domain = args.zoneTrans.domain
elseif args.domain then
domain = args.domain
elseif host.targetname then
domain = host.targetname
elseif host.name ~= "" then
domain = host.name
else
-- can't do anything without a hostname
return
end
assert(domain)
soc = nmap.new_socket()
soc:set_timeout(4000)
try(soc:connect(host.ip, port.number))
local req_id = '\222\173'
local table = tab.new(3)
local offset = 1
local name = build_domain(string.lower(host.name))
local name = build_domain(string.lower(domain))
local pkt_len = string.len(name) + 16
-- build axfr request