passivedns-client 1.3.0 → 1.3.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +17 -17
- data/bin/pdnstool +10 -10
- data/lib/passivedns/client/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 49cc9d7810af4882b1baca23cd5066c42064cc04
|
|
4
|
+
data.tar.gz: ab776bf92b0aa16d43ad33745dd9bf1a0ab16bea
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9d600182b9e748b3bc809afdf0605aa679119395dce243d8f5616744289bab90a8ca58132d10d61580fa0300a2b64a0ef0ae9a2b2de856d5261f3fe27c9f1b3c
|
|
7
|
+
data.tar.gz: 4be5b593b42516174bb70c53da866f99c714a9d666695f5f92e0a85788944a0de34800da39fc93283446b39ca3db6892bb3476259174fb6288e1d31e7e331a8e
|
data/README.md
CHANGED
|
@@ -25,14 +25,6 @@ Or install it yourself as:
|
|
|
25
25
|
|
|
26
26
|
## Configuration
|
|
27
27
|
|
|
28
|
-
### DNSParse
|
|
29
|
-
|
|
30
|
-
The pdnstool looks for a configuration file for DNSParse to be located at $HOME/.dnsparse by default. It requires three items of information, one per line: the base URL, a username, and a password. E.g.,
|
|
31
|
-
|
|
32
|
-
https://dnsparse.wherever/query.php?submit=Search&format=json&querytext=
|
|
33
|
-
myusername
|
|
34
|
-
mypassword
|
|
35
|
-
|
|
36
28
|
### DNSDB (Farsight Security)
|
|
37
29
|
|
|
38
30
|
The DNSDB configuration file is located at $HOME/.dnsdb-query.conf by default. The format for its configuration file only requires one line in the following format:
|
|
@@ -55,22 +47,29 @@ VirusTotal's (https://www.virustotal.com) passive DNS database requires an apik
|
|
|
55
47
|
01234567890abcdef01234567890abcdef01234567890abcdef01234567890abcdef
|
|
56
48
|
|
|
57
49
|
|
|
50
|
+
### TCPIPUtils
|
|
51
|
+
|
|
52
|
+
TCPIPUtils's (http://www.tcpiputils.com/premium-access) passive DNS database requires and apikey in $HOME/.tcpiputils. It is a 64 character hexstring on a single line.
|
|
53
|
+
|
|
54
|
+
01234567890abcdef01234567890abcdef01234567890abcdef01234567890abcdef
|
|
55
|
+
|
|
58
56
|
## Usage
|
|
59
57
|
|
|
60
58
|
require 'passivedns-client'
|
|
61
59
|
|
|
62
|
-
c = PassiveDNS::Client.new(['bfk','dnsdb']) # providers: bfk,
|
|
60
|
+
c = PassiveDNS::Client.new(['bfk','dnsdb']) # providers: bfk, tcpiputils, certee, dnsdb, virustotal
|
|
63
61
|
results = c.query("example.com")
|
|
64
62
|
|
|
65
63
|
Or use the included tool!
|
|
66
64
|
|
|
67
|
-
Usage: bin/pdnstool [-
|
|
68
|
-
-
|
|
69
|
-
-
|
|
70
|
-
-
|
|
71
|
-
-
|
|
72
|
-
-
|
|
73
|
-
-
|
|
65
|
+
Usage: bin/pdnstool [-d [bedvt]] [-g|-v|-m|-c|-x|-y|-j|-t] [-os <sep>] [-f <file>] [-r#|-w#|-v] [-l <count>] <ip|domain|cidr>
|
|
66
|
+
-dbedvt uses all of the available passive dns databases
|
|
67
|
+
-db only use BFK
|
|
68
|
+
-de only use CERT-EE (default)
|
|
69
|
+
-dd only use DNSDB (formerly ISC)
|
|
70
|
+
-dv only use VirusTotal
|
|
71
|
+
-dt only use TCPIPUtils
|
|
72
|
+
-dvt uses VirusTotal and TCPIPUtils (for example)
|
|
74
73
|
|
|
75
74
|
-g outputs a link-nodal GDF visualization definition
|
|
76
75
|
-v outputs a link-nodal graphviz visualization definition
|
|
@@ -85,7 +84,8 @@ Or use the included tool!
|
|
|
85
84
|
-f[file] specifies a sqlite3 database used to read the current state - useful for large result sets and generating graphs of previous runs.
|
|
86
85
|
-r# specifies the levels of recursion to pull. **WARNING** This is quite taxing on the pDNS servers, so use judiciously (never more than 3 or so) or find yourself blocked!
|
|
87
86
|
-w# specifies the amount of time to wait, in seconds, between queries (Default: 0)
|
|
88
|
-
-
|
|
87
|
+
-v outputs debugging information
|
|
88
|
+
-l <count> limits the number of records returned per passive dns database queried.
|
|
89
89
|
|
|
90
90
|
## Contributing
|
|
91
91
|
|
data/bin/pdnstool
CHANGED
|
@@ -49,7 +49,7 @@ def printresults(state,format,sep="\t")
|
|
|
49
49
|
end
|
|
50
50
|
|
|
51
51
|
def usage
|
|
52
|
-
puts "Usage: #{$0} [-d [bedvt]] [-
|
|
52
|
+
puts "Usage: #{$0} [-d [bedvt]] [-g|-v|-m|-c|-x|-y|-j|-t] [-os <sep>] [-f <file>] [-r#|-w#|-v] [-l <count>] <ip|domain|cidr>"
|
|
53
53
|
puts " -dbedvt uses all of the available passive dns databases"
|
|
54
54
|
puts " -db only use BFK"
|
|
55
55
|
puts " -de only use CERT-EE (default)"
|
|
@@ -58,15 +58,15 @@ def usage
|
|
|
58
58
|
puts " -dt only use TCPIPUtils"
|
|
59
59
|
puts " -dvt uses VirusTotal and TCPIPUtils (for example)"
|
|
60
60
|
puts ""
|
|
61
|
-
puts " -
|
|
62
|
-
puts " -
|
|
63
|
-
puts " -
|
|
64
|
-
puts " -
|
|
65
|
-
puts " -
|
|
66
|
-
puts " -
|
|
67
|
-
puts " -
|
|
68
|
-
puts " -
|
|
69
|
-
puts " -
|
|
61
|
+
puts " -g outputs a link-nodal GDF visualization definition"
|
|
62
|
+
puts " -v outputs a link-nodal graphviz visualization definition"
|
|
63
|
+
puts " -m output a link-nodal graphml visualization definition"
|
|
64
|
+
puts " -c outputs CSV"
|
|
65
|
+
puts " -x outputs XML"
|
|
66
|
+
puts " -y outputs YAML"
|
|
67
|
+
puts " -j outputs JSON"
|
|
68
|
+
puts " -t outputs ASCII text (default)"
|
|
69
|
+
puts " -s <sep> specifies a field separator for text output, default is tab"
|
|
70
70
|
puts ""
|
|
71
71
|
puts " -f[file] specifies a sqlite3 database used to read the current state - useful for large result sets and generating graphs of previous runs."
|
|
72
72
|
puts " -r# specifies the levels of recursion to pull. **WARNING** This is quite taxing on the pDNS servers, so use judiciously (never more than 3 or so) or find yourself blocked!"
|