rogue_one 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da6511f3f76c39a222c7b41458dd08675358923709006f56452e966369f166c9
-  data.tar.gz: 99ecea46070225babfb4c2b5f9d51da679a026afb22a443cadb6939e7507b697
+  metadata.gz: 6967b5c72247d5e6709f0ba71a7402bd181ec8dec2bdc6caa8bd588a01c9d409
+  data.tar.gz: 2a79181907673bb4c64b97fe706ce3a3d200260d71f361117f6b42d0fd3c4ba6
 SHA512:
-  metadata.gz: 7436a460f227a78b52d6bf57d85ac6e1f1b929f3b675aa02423f8cc5dc89a071cf01dc639e9ae20b688cb350bd99ec3cfef54332a07c56007b1364d82f96daab
-  data.tar.gz: 053b1f8f9a5c6eb5bf8b10654899bf7a41e106fa7fe412ce4e1fd27ad1917efd822a121464ba873ec698ea7d424d553cde8e85cd2f0ca53d26dd6cf11ac26b63
+  metadata.gz: 910aa8d5b1715407536204b63ac365006ff5ae0b7b09e51d42fcae4391a0be7cb1139f25c7131d3f14b386bb1e283f4be14a5b1d7a1b35a8fc01e18fbce21359
+  data.tar.gz: c408c4cba8b1b170771adf46132357221db2c00100cfb0991f5547c386d299bbb129dd375609636bd426feae46a06c3dd91cdfdc73ba9528f453c665e471870e

data/README.md

@@ -5,7 +5,9 @@
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/rogue_one/badge)](https://www.codefactor.io/repository/github/ninoseki/rogue_one)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/rogue_one/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/rogue_one?branch=master)
 
-A tiny tool for detecting a rogue DNS server and extracting landing pages from the rogue DNS server.
+A PoC tool for analyzing a rogue DNS server.
+
+This tool could be used for checking maliciousness of a DNS server and extracting landing pages.
 
 ## How it works
 
@@ -14,8 +16,9 @@ A tiny tool for detecting a rogue DNS server and extracting landing pages from t
 IPv4 space is vast. But an attacker could secure a few numbers of IP addresses for landing pages.
 It means you can (probably) find malicious landing pages by using the following methods.
 
-- Resolving a bunch of domains by using a rogue DNS.
+- Resolving a bunch of domains by using a DNS server.
 - Finding frequent IPv4s from the resolutions. They might be landing pages.
+- If a DNS server has landing pages, it might be a rogue one.
 
 ## Installation
 
@@ -37,6 +40,7 @@ Usage:
 
 Options:
   [--custom-list=CUSTOM_LIST]  # A path to a custom list of domains
+  [--threshold=N]              # Threshold value for determining malicious or not
   [--verbose], [--no-verbose]
 
 Show a report of a given DNS server
@@ -71,7 +75,7 @@ $ rogue_one report 171.244.3.111 --custom-list tmp/roaming.yml
 ```
 
 | Key           | Desc.                                                                    |
-|---------------|--------------------------------------------------------------------------|
+| ------------- | ------------------------------------------------------------------------ |
 | verdict       | A detection result (`rogue one` or `benign one`)                         |
 | landing_pages | An array of IP of landing pages                                          |
 | results       | DNS resolution results (only available if --verbose option is specified) |

data/lib/rogue_one/cli.rb

@@ -7,14 +7,16 @@ module RogueOne
   class CLI < Thor
     desc "report [DNS_SERVER]", "Show a report of a given DNS server"
     method_option :custom_list, type: :string, desc: "A path to a custom list of domains"
+    method_option :threshold, type: :numeric, desc: "Threshold value for determining malicious or not"
     method_option :verbose, type: :boolean
     def report(dns_server)
       with_error_handling do
         Ping.pong? dns_server
 
         custom_list = options["custom_list"]
+        threshold = options["threshold"]
         verbose = options["verbose"]
-        detector = Detector.new(target: dns_server, custom_list: custom_list, verbose: verbose)
+        detector = Detector.new(target: dns_server, custom_list: custom_list, threshold: threshold, verbose: verbose)
         puts JSON.pretty_generate(detector.report)
       end
     end

data/lib/rogue_one/detector.rb

@@ -11,9 +11,10 @@ module RogueOne
 
     GOOGLE_PUBLIC_DNS = "8.8.8.8"
 
-    def initialize(target:, custom_list: nil, verbose: false)
+    def initialize(target:, custom_list: nil, threshold: nil, verbose: false)
       @target = target
       @custom_list = custom_list
+      @threshold = threshold
       @verbose = verbose
 
       @memo = {}
@@ -23,7 +24,12 @@ module RogueOne
     def report
       inspect
 
-      { verdict: verdict, landing_pages: landing_pages, results: results }.compact
+      {
+        verdict: verdict,
+        landing_pages: landing_pages,
+        results: results,
+        meta: meta
+      }.compact
     end
 
     private
@@ -40,6 +46,12 @@ module RogueOne
       @threshold ||= (domains.length.to_f / 10.0).ceil
     end
 
+    def meta
+      return nil unless verbose
+
+      { threshold: threshold }
+    end
+
     def landing_pages
       @memo.map do |ip, count|
         count > threshold ? ip : nil
@@ -47,17 +59,30 @@ module RogueOne
     end
 
     def results
-      @verbose_memo
+      return nil unless verbose
+
+      {
+        resolutions: resolutions,
+        occurrences: occurrences
+      }
+    end
+
+    def resolutions
+      (@verbose_memo || {}).sort_by { |_, v| v }.to_h
+    end
+
+    def occurrences
+      @memo.sort_by{ |_, v| -v }.to_h
     end
 
     def inspect
       return unless @memo.empty?
 
       results = Parallel.map(domains) do |domain|
-        normal_result = normal_resolver.dig(domain, "A")
-        target_result = target_resolver.dig(domain, "A")
+        normal_results = normal_resolver.get_resources(domain, "A")
+        target_result = target_resolver.get_resource(domain, "A")
 
-        [domain, target_result] if target_result && normal_result != target_result
+        [domain, target_result] if target_result && !normal_results.include?(target_result)
       end.compact.to_h
 
       @memo = results.values.group_by(&:itself).map { |k, v| [k, v.length] }.to_h

data/lib/rogue_one/ping.rb

@@ -9,7 +9,7 @@ module RogueOne
     end
 
     def pong?
-      result = resolver.dig("example.com", "A")
+      result = resolver.get_resource("example.com", "A")
       raise Error, "DNS resolve error: there is no resopnse from #{resolver.nameserver}" unless result
 
       true

data/lib/rogue_one/resolver.rb

@@ -10,9 +10,15 @@ module RogueOne
       @nameserver = nameserver
     end
 
-    def dig(domain, type)
+    def get_resource(domain, type)
       _resolver.getresource(domain, resource_by_type(type)).address.to_s
-    rescue Resolv::ResolvError => e
+    rescue Resolv::ResolvError => _e
+      nil
+    end
+
+    def get_resources(domain, type)
+      _resolver.getresources(domain, resource_by_type(type)).map { |r| r.address.to_s }
+    rescue Resolv::ResolvError => _e
       nil
     end
 

data/lib/rogue_one/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RogueOne
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/rogue_one.gemspec

@@ -10,8 +10,8 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Manabu Niseki"]
   spec.email         = ["manabu.niseki@gmail.com"]
 
-  spec.summary       = "Rogue one: a rogue DNS detector"
-  spec.description   = 'Rogue one: a rogue DNS detector'
+  spec.summary       = "A rogue DNS detector"
+  spec.description   = "A rogue DNS detector"
   spec.homepage      = "https://github.com/ninoseki/rogue_one"
   spec.license       = "MIT"
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rogue_one
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-10-29 00:00:00.000000000 Z
+date: 2019-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -94,7 +94,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.20'
-description: 'Rogue one: a rogue DNS detector'
+description: A rogue DNS detector
 email:
 - manabu.niseki@gmail.com
 executables:
@@ -144,5 +144,5 @@ requirements: []
 rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
-summary: 'Rogue one: a rogue DNS detector'
+summary: A rogue DNS detector
 test_files: []