7.4 KiB
DNSRecon - Passive Infrastructure Reconnaissance Tool
DNSRecon is an interactive, passive reconnaissance tool designed to map adversary infrastructure. It operates on a "free-by-default" model, ensuring core functionality without subscriptions, while allowing power users to enhance its capabilities with paid API keys.
Current Status: Phase 2 Implementation
- ✅ Core infrastructure and graph engine
- ✅ Multi-provider support (crt.sh, DNS, Shodan)
- ✅ Session-based multi-user support
- ✅ Real-time web interface with interactive visualization
- ✅ Forensic logging system and JSON export
Features
- Passive Reconnaissance: Gathers data without direct contact with target infrastructure.
- In-Memory Graph Analysis: Uses NetworkX for efficient relationship mapping.
- Real-Time Visualization: The graph updates dynamically as the scan progresses.
- Forensic Logging: A complete audit trail of all reconnaissance activities is maintained.
- Confidence Scoring: Relationships are weighted based on the reliability of the data source.
- Session Management: Supports concurrent user sessions with isolated scanner instances.
Installation
Prerequisites
- Python 3.8 or higher
- A modern web browser with JavaScript enabled
- (Recommended) A Linux host for running the application and the optional DNS cache.
1. Clone the Project
git clone https://github.com/your-repo/dnsrecon.git
cd dnsrecon
2. Install Python Dependencies
It is highly recommended to use a virtual environment:
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
3. (Optional but Recommended) Set up a Local DNS Caching Resolver
Running a local DNS caching resolver can significantly speed up DNS queries and reduce your network footprint. Here’s how to set up unbound on a Debian-based Linux distribution (like Ubuntu).
a. Install Unbound:
sudo apt update
sudo apt install unbound -y
b. Configure Unbound: Create a new configuration file for DNSRecon:
sudo nano /etc/unbound/unbound.conf.d/dnsrecon.conf
Add the following content to the file:
server:
# Listen on localhost for all users
interface: 127.0.0.1
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
# Enable prefetching of popular items
prefetch: yes
c. Restart Unbound and set it as the default resolver:
sudo systemctl restart unbound
sudo systemctl enable unbound
To use this resolver for your system, you may need to update your network settings to point to 127.0.0.1 as your DNS server.
d. Update DNSProvider to use the local resolver:
In dnsrecon/providers/dns_provider.py, you can explicitly set the resolver's nameservers in the __init__ method:
# dnsrecon/providers/dns_provider.py
class DNSProvider(BaseProvider):
def __init__(self, session_config=None):
"""Initialize DNS provider with session-specific configuration."""
super().__init__(...)
# Configure DNS resolver
self.resolver = dns.resolver.Resolver()
self.resolver.nameservers = ['127.0.0.1'] # Use local caching resolver
self.resolver.timeout = 5
self.resolver.lifetime = 10
Usage (Development)
1. Start the Application
python app.py
2. Open Your Browser
Navigate to http://127.0.0.1:5000.
3. Basic Reconnaissance Workflow
- Enter Target Domain: Input a domain like
example.com. - Select Recursion Depth: Depth 2 is recommended for most investigations.
- Start Reconnaissance: Click "Start Reconnaissance" to begin.
- Monitor Progress: Watch the real-time graph build as relationships are discovered.
- Analyze and Export: Interact with the graph and download the results when the scan is complete.
Production Deployment
To deploy DNSRecon in a production environment, follow these steps:
1. Use a Production WSGI Server
Do not use the built-in Flask development server for production. Use a WSGI server like Gunicorn:
pip install gunicorn
gunicorn --workers 4 --bind 0.0.0.0:5000 app:app
2. Configure Environment Variables
Set the following environment variables for a secure and configurable deployment:
# Generate a strong, random secret key
export SECRET_KEY='your-super-secret-and-random-key'
# Set Flask to production mode
export FLASK_ENV='production'
export FLASK_DEBUG=False
# API keys (optional, but recommended for full functionality)
export SHODAN_API_KEY="your_shodan_key"
3. Use a Reverse Proxy
Set up a reverse proxy like Nginx to sit in front of the Gunicorn server. This provides several benefits, including:
- TLS/SSL Termination: Securely handle HTTPS traffic.
- Load Balancing: Distribute traffic across multiple application instances.
- Serving Static Files: Efficiently serve CSS and JavaScript files.
Example Nginx Configuration:
server {
listen 80;
server_name your_domain.com;
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl;
server_name your_domain.com;
# SSL cert configuration
ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /static {
alias /path/to/your/dnsrecon/static;
expires 30d;
}
}
Autostart with systemd
To run DNSRecon as a service that starts automatically on boot, you can use systemd.
1. Create a .service file
Create a new service file in /etc/systemd/system/:
sudo nano /etc/systemd/system/dnsrecon.service
2. Add the Service Configuration
Paste the following configuration into the file. Remember to replace /path/to/your/dnsrecon and your_user with your actual project path and username.
[Unit]
Description=DNSRecon Application
After=network.target
[Service]
User=your_user
Group=your_user
WorkingDirectory=/path/to/your/dnsrecon
ExecStart=/path/to/your/dnsrecon/venv/bin/gunicorn --workers 4 --bind 0.0.0.0:5000 app:app
Restart=always
Environment="SECRET_KEY=your-super-secret-and-random-key"
Environment="FLASK_ENV=production"
Environment="FLASK_DEBUG=False"
Environment="SHODAN_API_KEY=your_shodan_key"
[Install]
WantedBy=multi-user.target
3. Enable and Start the Service
Reload the systemd daemon, enable the service to start on boot, and then start it immediately:
sudo systemctl daemon-reload
sudo systemctl enable dnsrecon.service
sudo systemctl start dnsrecon.service
You can check the status of the service at any time with:
sudo systemctl status dnsrecon.service
Security Considerations
- API Keys: API keys are stored in memory for the duration of a user session and are not written to disk.
- Rate Limiting: DNSRecon includes built-in rate limiting to be respectful to data sources.
- Local Use: The application is designed for local or trusted network use and does not have built-in authentication. Do not expose it directly to the internet without proper security controls.
License
This project is licensed under the terms of the license agreement found in the LICENSE file.