dns-cache-snoop
脚本使用类型:
portrule
脚本所属分类:
intrusive, discovery
脚本下载地址: http://nmap.org/svn/scripts/dns-cache-snoop.nse
Performs DNS cache snooping against a DNS server.
There are two modes of operation, controlled by the
dns-cache-snoop.mode script argument. In
nonrecursive mode (the default), queries are sent to the
server with the RD (recursion desired) flag set to 0. The server should
respond positively to these only if it has the domain cached. In
timed mode, the mean and standard deviation response times
for a cached domain are calculated by sampling the resolution of a name
(www.google.com) several times. Then, each domain is resolved and the
time taken compared to the mean. If it is less than one standard
deviation over the mean, it is considered cached. The timed
mode inserts entries in the cache and can only be used reliably once.
The default list of domains to check consists of the top 50 most popular
sites, each site being listed twice, once with "www." and once without.
Use the dns-cache-snoop.domains script argument to use a
different list.
which of two supported snooping methods to
use. nonrecursive, the default, checks if the server
returns results for non-recursive queries. Some servers may disable
this. timed measures the difference in time taken to
resolve cached and non-cached hosts. This mode will pollute the DNS
cache and can only be used once reliably.
an array of domain to check in place of the default list.
执行格式
nmap -sU -p 53 --script dns-cache-snoop.nse --script-args 'dns-cache-snoop.mode=timed,dns-cache-snoop.domains={host1,host2,host3}' <target>
PORT STATE SERVICE REASON 53/udp open domain udp-response | dns-cache-snoop: 10 of 100 tested domains are cached. | www.google.com | facebook.com | www.facebook.com | www.youtube.com | yahoo.com | twitter.com | www.twitter.com | www.google.com.hk | www.google.co.uk |_www.linkedin.com
Author: Eugene V. Alexeev
License: VER007 整理 http://www.ver007.com