From 3512576c9b269f3fb3c7748559ddd5d46a4d4696 Mon Sep 17 00:00:00 2001 From: kris Date: Thu, 5 Jun 2008 04:22:27 +0000 Subject: [PATCH] zoneTrans.nse now takes a "domain" script argument to specify the domain name to transfer. I've only been able to examine the behavior through Wireshark since I don't have a nameserver that transfers other domains (I always get "Not Authoritative"). It seems to work fine, though --- CHANGELOG | 4 ++++ scripts/zoneTrans.nse | 30 +++++++++++++++++++++++------- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index abac8bb6f..ed0edf3b9 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -11,6 +11,10 @@ o Nmap now returns correct values for --iflist in windows even o Nmap no longer crashes with an 'assert' error when its told to access a disabled wifi NIC on some laptops. [Michael] +o The zoneTrans.nse script now takes a "domain" script argument to + specify the desired domain name to transfer. You can narrow the + scope down with the form "zoneTrans={domain=xxx}". [Kris] + Nmap 4.65 [2008-6-1] o A Mac OS X Nmap/Zenmap installer is now available from the Nmap diff --git a/scripts/zoneTrans.nse b/scripts/zoneTrans.nse index 8e7a15d64..9e47e40a5 100644 --- a/scripts/zoneTrans.nse +++ b/scripts/zoneTrans.nse @@ -1,9 +1,10 @@ --[[ Send axfr queries to DNS servers. The domain to query is determined -by examining the domain servers hostname. If the query is successful -all domains and domain types are returned along with common type -specific data (SOA/MX/NS/PTR/A) +by examining the name given on the command line, the domain servers +hostname, or it can be specified with the "domain" script argument. +If the query is successful all domains and domain types are returned +along with common type specific data (SOA/MX/NS/PTR/A) constraints ----------- @@ -263,17 +264,32 @@ action = function(host, port) local catch = function() soc:close() end local try = nmap.new_try(catch) - -- can't do anything without a hostname - if host.name == "" then return nil end + local domain = nil + local args = nmap.registry.args + + if args.zoneTrans and args.zoneTrans.domain then + domain = args.zoneTrans.domain + elseif args.domain then + domain = args.domain + elseif host.targetname then + domain = host.targetname + elseif host.name ~= "" then + domain = host.name + else + -- can't do anything without a hostname + return + end + + assert(domain) soc = nmap.new_socket() soc:set_timeout(4000) try(soc:connect(host.ip, port.number)) - + local req_id = '\222\173' local table = tab.new(3) local offset = 1 - local name = build_domain(string.lower(host.name)) + local name = build_domain(string.lower(domain)) local pkt_len = string.len(name) + 16 -- build axfr request