passivedns-client 1.3.0 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +17 -17
- data/bin/pdnstool +10 -10
- data/lib/passivedns/client/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 49cc9d7810af4882b1baca23cd5066c42064cc04
|
|
4
|
+
data.tar.gz: ab776bf92b0aa16d43ad33745dd9bf1a0ab16bea
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9d600182b9e748b3bc809afdf0605aa679119395dce243d8f5616744289bab90a8ca58132d10d61580fa0300a2b64a0ef0ae9a2b2de856d5261f3fe27c9f1b3c
|
|
7
|
+
data.tar.gz: 4be5b593b42516174bb70c53da866f99c714a9d666695f5f92e0a85788944a0de34800da39fc93283446b39ca3db6892bb3476259174fb6288e1d31e7e331a8e
|
data/README.md
CHANGED
|
@@ -25,14 +25,6 @@ Or install it yourself as:
|
|
|
25
25
|
|
|
26
26
|
## Configuration
|
|
27
27
|
|
|
28
|
-
### DNSParse
|
|
29
|
-
|
|
30
|
-
The pdnstool looks for a configuration file for DNSParse to be located at $HOME/.dnsparse by default. It requires three items of information, one per line: the base URL, a username, and a password. E.g.,
|
|
31
|
-
|
|
32
|
-
https://dnsparse.wherever/query.php?submit=Search&format=json&querytext=
|
|
33
|
-
myusername
|
|
34
|
-
mypassword
|
|
35
|
-
|
|
36
28
|
### DNSDB (Farsight Security)
|
|
37
29
|
|
|
38
30
|
The DNSDB configuration file is located at $HOME/.dnsdb-query.conf by default. The format for its configuration file only requires one line in the following format:
|
|
@@ -55,22 +47,29 @@ VirusTotal's (https://www.virustotal.com) passive DNS database requires an apik
|
|
|
55
47
|
01234567890abcdef01234567890abcdef01234567890abcdef01234567890abcdef
|
|
56
48
|
|
|
57
49
|
|
|
50
|
+
### TCPIPUtils
|
|
51
|
+
|
|
52
|
+
TCPIPUtils's (http://www.tcpiputils.com/premium-access) passive DNS database requires and apikey in $HOME/.tcpiputils. It is a 64 character hexstring on a single line.
|
|
53
|
+
|
|
54
|
+
01234567890abcdef01234567890abcdef01234567890abcdef01234567890abcdef
|
|
55
|
+
|
|
58
56
|
## Usage
|
|
59
57
|
|
|
60
58
|
require 'passivedns-client'
|
|
61
59
|
|
|
62
|
-
c = PassiveDNS::Client.new(['bfk','dnsdb']) # providers: bfk,
|
|
60
|
+
c = PassiveDNS::Client.new(['bfk','dnsdb']) # providers: bfk, tcpiputils, certee, dnsdb, virustotal
|
|
63
61
|
results = c.query("example.com")
|
|
64
62
|
|
|
65
63
|
Or use the included tool!
|
|
66
64
|
|
|
67
|
-
Usage: bin/pdnstool [-
|
|
68
|
-
-
|
|
69
|
-
-
|
|
70
|
-
-
|
|
71
|
-
-
|
|
72
|
-
-
|
|
73
|
-
-
|
|
65
|
+
Usage: bin/pdnstool [-d [bedvt]] [-g|-v|-m|-c|-x|-y|-j|-t] [-os <sep>] [-f <file>] [-r#|-w#|-v] [-l <count>] <ip|domain|cidr>
|
|
66
|
+
-dbedvt uses all of the available passive dns databases
|
|
67
|
+
-db only use BFK
|
|
68
|
+
-de only use CERT-EE (default)
|
|
69
|
+
-dd only use DNSDB (formerly ISC)
|
|
70
|
+
-dv only use VirusTotal
|
|
71
|
+
-dt only use TCPIPUtils
|
|
72
|
+
-dvt uses VirusTotal and TCPIPUtils (for example)
|
|
74
73
|
|
|
75
74
|
-g outputs a link-nodal GDF visualization definition
|
|
76
75
|
-v outputs a link-nodal graphviz visualization definition
|
|
@@ -85,7 +84,8 @@ Or use the included tool!
|
|
|
85
84
|
-f[file] specifies a sqlite3 database used to read the current state - useful for large result sets and generating graphs of previous runs.
|
|
86
85
|
-r# specifies the levels of recursion to pull. **WARNING** This is quite taxing on the pDNS servers, so use judiciously (never more than 3 or so) or find yourself blocked!
|
|
87
86
|
-w# specifies the amount of time to wait, in seconds, between queries (Default: 0)
|
|
88
|
-
-
|
|
87
|
+
-v outputs debugging information
|
|
88
|
+
-l <count> limits the number of records returned per passive dns database queried.
|
|
89
89
|
|
|
90
90
|
## Contributing
|
|
91
91
|
|
data/bin/pdnstool
CHANGED
|
@@ -49,7 +49,7 @@ def printresults(state,format,sep="\t")
|
|
|
49
49
|
end
|
|
50
50
|
|
|
51
51
|
def usage
|
|
52
|
-
puts "Usage: #{$0} [-d [bedvt]] [-
|
|
52
|
+
puts "Usage: #{$0} [-d [bedvt]] [-g|-v|-m|-c|-x|-y|-j|-t] [-os <sep>] [-f <file>] [-r#|-w#|-v] [-l <count>] <ip|domain|cidr>"
|
|
53
53
|
puts " -dbedvt uses all of the available passive dns databases"
|
|
54
54
|
puts " -db only use BFK"
|
|
55
55
|
puts " -de only use CERT-EE (default)"
|
|
@@ -58,15 +58,15 @@ def usage
|
|
|
58
58
|
puts " -dt only use TCPIPUtils"
|
|
59
59
|
puts " -dvt uses VirusTotal and TCPIPUtils (for example)"
|
|
60
60
|
puts ""
|
|
61
|
-
puts " -
|
|
62
|
-
puts " -
|
|
63
|
-
puts " -
|
|
64
|
-
puts " -
|
|
65
|
-
puts " -
|
|
66
|
-
puts " -
|
|
67
|
-
puts " -
|
|
68
|
-
puts " -
|
|
69
|
-
puts " -
|
|
61
|
+
puts " -g outputs a link-nodal GDF visualization definition"
|
|
62
|
+
puts " -v outputs a link-nodal graphviz visualization definition"
|
|
63
|
+
puts " -m output a link-nodal graphml visualization definition"
|
|
64
|
+
puts " -c outputs CSV"
|
|
65
|
+
puts " -x outputs XML"
|
|
66
|
+
puts " -y outputs YAML"
|
|
67
|
+
puts " -j outputs JSON"
|
|
68
|
+
puts " -t outputs ASCII text (default)"
|
|
69
|
+
puts " -s <sep> specifies a field separator for text output, default is tab"
|
|
70
70
|
puts ""
|
|
71
71
|
puts " -f[file] specifies a sqlite3 database used to read the current state - useful for large result sets and generating graphs of previous runs."
|
|
72
72
|
puts " -r# specifies the levels of recursion to pull. **WARNING** This is quite taxing on the pDNS servers, so use judiciously (never more than 3 or so) or find yourself blocked!"
|