DNS Extraction and Visualization Algorithms

Universidade Lusófona de Humanidades e Tecnologias
Instituto de Telecomunicações
Universidade da Beira Interior

Algorithms for extraction and visualization of
meta-data from Domain Name Server records

Arley Leal Silveira
Nuno M. Garcia

arleybls@gmail.com, ngarcia@professores.ulusofona.pt
== MESH 2010, 20th July 2010, Mestre / Venice, Italy ==

Algorithms for extraction and visualization of meta-data from Domain Name Server records

Agenda

Introduction / Motivation

Algorithms

Results

Conclusions

ngarcia@professores.ulusofona.pt 2


Introduction

Domain Name System is a distributed
hierarchical network service / infra-structure
that contains the relations between the names
and the IP addresses of machines who deliver
services over an IP network.

Typically a large organization deploys its own
DNS server(s).

To manage the information in these servers can
be ... troublesome.


Introduction / Motivation

“ If you know the enemy and know yourself, you
need not fear the result of a hundred battles. If
you know yourself but not the enemy, for every
victory gained you will also suffer a defeat. If
you know neither the enemy nor yourself, you
will succumb in every battle.”
Sun Tzu, the Art of War



Algorithms

There are a number of tools which already
do this (DioNiSio, dnsmap, dnsenum, ...)

We combined all the goodies from other tools,
and added typing errors (several ﬂavours)
and transposition.



Algorithms

We can query the DNS database, to look for
responses for URL names.

We can use a number of strategies

TLD rotation

brute force

dictionary attack

typing errors


Algorithms

TDL rotation

brute force

dictionary attack

typing errors

Can be used conjointly, and deploying threads.



Algorithms

TLD rotation

uses the TLD deﬁnition from IANA

looks for domains which are similar to the
one we want, except on the TLD domain
sufﬁx, incluing second level TLD domains.



Algorithms

TLD
rotation



Algorithms

Brute force

generates random words from a set of
characters and numbers, up to a deﬁned
length

looks for sub-domains of the domain we
want.



Algorithms

Brute
force



Algorithms

Dictionary attack

uses words from a list (dictionary)

looks for sub-domains of the domain we
want.



Algorithms

Dictionary
attack



Algorithms

Typing errors

uses three different approaches

transposition (using the key close the one you
wanted to type)

double typing (doublee typingg)

omission (omssion)

looks for domains that are similar to the domain
we want.



Algorithms

Typing
errors



Integration with a visualization tool

txdns is usable with Maltego from Paterva

to achieve this, the standard output of the tool
was redirected to an XML stream formatted
according to the rules of Maltego;

you also need to create a resource, and add a
DNS context to the Maltego workspace;

Maltego allows for a intuitive visualization of
the data, and to query again a previously
obtained result.



Conclusions

txdns implements several strategies and algorithms to query the
DNS infrastructure;
it is deployable using threads, and it was build in C, so it is
portable;
may be integrated with visualization tools such as Paterva’s
Maltego;
both the executable ﬁle and the source code are avaliable online ate
http://netlab.ulusofona.pt/id

Thank you. Questions?



CONCLUSIONS
txdns implements several Thank you!
strategies and algorithms to
query the DNS
Questions?
infrastructure;
it is deployable using Algorithms for extraction and
threads, and it was build in
C, so it is portable; visualization of meta-data from
may be integrated with Domain Name Server records
visualization tools such as
Paterva’s Maltego;
Arley Leal Silveira
both the executable ﬁle and
Nuno M. Garcia
the source code are avaliable
online ate http:// arleybls@gmail.com, ngarcia@professores.ulusofona.pt
netlab.ulusofona.pt/id MESH 2010, 20th July 2010, Mestre / Venice, Italy


DNS Extraction and Visualization Algorithms

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie DNS Extraction and Visualization Algorithms

Ähnlich wie DNS Extraction and Visualization Algorithms (20)

DNS Extraction and Visualization Algorithms