rogue_one 0.3.0 → 0.4.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/test.yaml +23 -0
- data/Gemfile +2 -0
- data/README.md +9 -5
- data/Rakefile +3 -1
- data/bin/console +1 -0
- data/exe/rogue_one +3 -1
- data/lib/rogue_one/cli.rb +20 -1
- data/lib/rogue_one/data/alexa_100.yml +101 -0
- data/lib/rogue_one/data/fortune_100.yml +101 -0
- data/lib/rogue_one/detector.rb +87 -19
- data/lib/rogue_one/domain_list.rb +0 -2
- data/lib/rogue_one/ping.rb +14 -4
- data/lib/rogue_one/version.rb +1 -1
- data/lib/rogue_one.rb +0 -1
- data/renovate.json +5 -0
- data/rogue_one.gemspec +5 -5
- metadata +22 -21
- data/.travis.yml +0 -7
- data/lib/rogue_one/data/top_100.yml +0 -101
- data/lib/rogue_one/resolver.rb +0 -55
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b93f5fd8739dbb15739809bba1f391a913d5e7e3a8822a07487f9942ee307ac6
|
4
|
+
data.tar.gz: c413a952f102a75f3bbf7db003373eebe1ecd8b0f92c52db345dbda3d562bff1
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 477c391a0c54c2889ff000048c24952355e2e9c26116a68c7748e6e64d16ca0657264c81a6ce6c56d2251c5d830c8075efd81ccfb3a6151d03914e083927c9a3
|
7
|
+
data.tar.gz: 3c4ebc1b64c51d0299c969363fd5d51223f4ef21912c4957ac8d8db1666295f3f070919674687935d48f2e45334f7d4e66fabb96ef4a39e36ef0a7b56c9f903e
|
@@ -0,0 +1,23 @@
|
|
1
|
+
name: Ruby CI
|
2
|
+
|
3
|
+
on: [pull_request]
|
4
|
+
|
5
|
+
jobs:
|
6
|
+
build:
|
7
|
+
runs-on: ubuntu-latest
|
8
|
+
|
9
|
+
strategy:
|
10
|
+
fail-fast: false
|
11
|
+
matrix:
|
12
|
+
ruby: [2.7, "3.0"]
|
13
|
+
|
14
|
+
steps:
|
15
|
+
- uses: actions/checkout@v2
|
16
|
+
- name: Set up Ruby
|
17
|
+
uses: ruby/setup-ruby@v1
|
18
|
+
with:
|
19
|
+
ruby-version: ${{ matrix.ruby }}
|
20
|
+
bundler-cache: true
|
21
|
+
- name: Build and test with Rake
|
22
|
+
run: |
|
23
|
+
bundle exec rake
|
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# Rogue one
|
2
2
|
|
3
3
|
[![Gem Version](https://badge.fury.io/rb/rogue_one.svg)](https://badge.fury.io/rb/rogue_one)
|
4
|
-
[![
|
4
|
+
[![Ruby CI](https://github.com/ninoseki/rogue_one/actions/workflows/test.yaml/badge.svg)](https://github.com/ninoseki/rogue_one/actions/workflows/test.yaml)
|
5
5
|
[![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/rogue_one/badge)](https://www.codefactor.io/repository/github/ninoseki/rogue_one)
|
6
6
|
[![Coverage Status](https://coveralls.io/repos/github/ninoseki/rogue_one/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/rogue_one?branch=master)
|
7
7
|
|
@@ -39,8 +39,12 @@ Usage:
|
|
39
39
|
rogue_one report [DNS_SERVER]
|
40
40
|
|
41
41
|
Options:
|
42
|
-
[--custom-list=CUSTOM_LIST]
|
43
|
-
[--
|
42
|
+
[--custom-list=CUSTOM_LIST] # A path to a custom list of domains
|
43
|
+
[--default-list=DEFAULT_LIST] # A default list of top 100 domains (Alexa or Fortune)
|
44
|
+
# Default: alexa
|
45
|
+
[--record-type=RECORD_TYPE] # A type of the DNS resource to check
|
46
|
+
# Default: A
|
47
|
+
[--threshold=N] # Threshold value for determining malicious or not
|
44
48
|
[--verbose], [--no-verbose]
|
45
49
|
|
46
50
|
Show a report of a given DNS server
|
@@ -71,11 +75,11 @@ $ rogue_one report 171.244.3.111 --custom-list tmp/roaming.yml
|
|
71
75
|
"58.82.243.9"
|
72
76
|
]
|
73
77
|
}
|
74
|
-
# Note: a custom list should be an array of domains in YAML
|
78
|
+
# Note: a custom list should be an array of domains in a YAML file.
|
75
79
|
```
|
76
80
|
|
77
81
|
| Key | Desc. |
|
78
|
-
|
82
|
+
|---------------|--------------------------------------------------------------------------|
|
79
83
|
| verdict | A detection result (`rogue one` or `benign one`) |
|
80
84
|
| landing_pages | An array of IP of landing pages |
|
81
85
|
| results | DNS resolution results (only available if --verbose option is specified) |
|
data/Rakefile
CHANGED
data/bin/console
CHANGED
data/exe/rogue_one
CHANGED
data/lib/rogue_one/cli.rb
CHANGED
@@ -5,8 +5,16 @@ require "json"
|
|
5
5
|
|
6
6
|
module RogueOne
|
7
7
|
class CLI < Thor
|
8
|
+
class << self
|
9
|
+
def exit_on_failure?
|
10
|
+
true
|
11
|
+
end
|
12
|
+
end
|
13
|
+
|
8
14
|
desc "report [DNS_SERVER]", "Show a report of a given DNS server"
|
9
15
|
method_option :custom_list, type: :string, desc: "A path to a custom list of domains"
|
16
|
+
method_option :default_list, type: :string, default: "alexa", desc: "A default list of top 100 domains (Alexa or Fortune)"
|
17
|
+
method_option :record_type, type: :string, default: "A", desc: "A type of the DNS resource to check"
|
10
18
|
method_option :threshold, type: :numeric, desc: "Threshold value for determining malicious or not"
|
11
19
|
method_option :verbose, type: :boolean
|
12
20
|
def report(dns_server)
|
@@ -14,12 +22,23 @@ module RogueOne
|
|
14
22
|
Ping.pong? dns_server
|
15
23
|
|
16
24
|
custom_list = options["custom_list"]
|
25
|
+
default_list = options["default_list"].downcase
|
26
|
+
record_type = options["record_type"].upcase
|
17
27
|
threshold = options["threshold"]
|
18
28
|
verbose = options["verbose"]
|
19
|
-
|
29
|
+
|
30
|
+
detector = Detector.new(
|
31
|
+
custom_list: custom_list,
|
32
|
+
default_list: default_list,
|
33
|
+
record_type: record_type,
|
34
|
+
target: dns_server,
|
35
|
+
threshold: threshold,
|
36
|
+
verbose: verbose,
|
37
|
+
)
|
20
38
|
puts JSON.pretty_generate(detector.report)
|
21
39
|
end
|
22
40
|
end
|
41
|
+
default_command :report
|
23
42
|
|
24
43
|
no_commands do
|
25
44
|
def with_error_handling
|
@@ -0,0 +1,101 @@
|
|
1
|
+
---
|
2
|
+
- google.com
|
3
|
+
- youtube.com
|
4
|
+
- tmall.com
|
5
|
+
- baidu.com
|
6
|
+
- qq.com
|
7
|
+
- sohu.com
|
8
|
+
- facebook.com
|
9
|
+
- login.tmall.com
|
10
|
+
- wikipedia.org
|
11
|
+
- taobao.com
|
12
|
+
- yahoo.com
|
13
|
+
- jd.com
|
14
|
+
- 360.cn
|
15
|
+
- amazon.com
|
16
|
+
- sina.com.cn
|
17
|
+
- weibo.com
|
18
|
+
- pages.tmall.com
|
19
|
+
- reddit.com
|
20
|
+
- live.com
|
21
|
+
- vk.com
|
22
|
+
- okezone.com
|
23
|
+
- netflix.com
|
24
|
+
- blogspot.com
|
25
|
+
- office.com
|
26
|
+
- csdn.net
|
27
|
+
- alipay.com
|
28
|
+
- xinhuanet.com
|
29
|
+
- stackoverflow.com
|
30
|
+
- yahoo.co.jp
|
31
|
+
- instagram.com
|
32
|
+
- google.com.hk
|
33
|
+
- aliexpress.com
|
34
|
+
- microsoft.com
|
35
|
+
- babytree.com
|
36
|
+
- naver.com
|
37
|
+
- twitter.com
|
38
|
+
- bing.com
|
39
|
+
- livejasmin.com
|
40
|
+
- amazon.co.jp
|
41
|
+
- tribunnews.com
|
42
|
+
- ebay.com
|
43
|
+
- salesforce.com
|
44
|
+
- twitch.tv
|
45
|
+
- google.co.in
|
46
|
+
- force.com
|
47
|
+
- microsoftonline.com
|
48
|
+
- apple.com
|
49
|
+
- tianya.cn
|
50
|
+
- adobe.com
|
51
|
+
- pornhub.com
|
52
|
+
- msn.com
|
53
|
+
- zhanqi.tv
|
54
|
+
- dropbox.com
|
55
|
+
- linkedin.com
|
56
|
+
- yandex.ru
|
57
|
+
- wordpress.com
|
58
|
+
- myshopify.com
|
59
|
+
- amazon.in
|
60
|
+
- mail.ru
|
61
|
+
- panda.tv
|
62
|
+
- imdb.com
|
63
|
+
- caijing.com.cn
|
64
|
+
- china.com.cn
|
65
|
+
- mama.cn
|
66
|
+
- amazonaws.com
|
67
|
+
- google.com.br
|
68
|
+
- trello.com
|
69
|
+
- bongacams.com
|
70
|
+
- google.de
|
71
|
+
- medium.com
|
72
|
+
- google.co.jp
|
73
|
+
- soso.com
|
74
|
+
- booking.com
|
75
|
+
- w3schools.com
|
76
|
+
- amazon.co.uk
|
77
|
+
- spotify.com
|
78
|
+
- amazon.de
|
79
|
+
- rednet.cn
|
80
|
+
- bbc.com
|
81
|
+
- detail.tmall.com
|
82
|
+
- xvideos.com
|
83
|
+
- espn.com
|
84
|
+
- detik.com
|
85
|
+
- github.com
|
86
|
+
- cnn.com
|
87
|
+
- instructure.com
|
88
|
+
- ok.ru
|
89
|
+
- indeed.com
|
90
|
+
- yy.com
|
91
|
+
- tumblr.com
|
92
|
+
- huanqiu.com
|
93
|
+
- stackexchange.com
|
94
|
+
- nytimes.com
|
95
|
+
- imgur.com
|
96
|
+
- soundcloud.com
|
97
|
+
- whatsapp.com
|
98
|
+
- rakuten.co.jp
|
99
|
+
- nih.gov
|
100
|
+
- sogou.com
|
101
|
+
- google.cn
|
@@ -0,0 +1,101 @@
|
|
1
|
+
---
|
2
|
+
- walmart.com
|
3
|
+
- exxonmobil.com
|
4
|
+
- berkshirehathaway.com
|
5
|
+
- apple.com
|
6
|
+
- unitedhealthgroup.com
|
7
|
+
- mckesson.com
|
8
|
+
- cvshealth.com
|
9
|
+
- amazon.com
|
10
|
+
- att.com
|
11
|
+
- gm.com
|
12
|
+
- ford.com
|
13
|
+
- amerisourcebergen.com
|
14
|
+
- chevron.com
|
15
|
+
- cardinalhealth.com
|
16
|
+
- costco.com
|
17
|
+
- verizon.com
|
18
|
+
- kroger.com
|
19
|
+
- ge.com
|
20
|
+
- walgreensbootsalliance.com
|
21
|
+
- jpmorganchase.com
|
22
|
+
- fanniemae.com
|
23
|
+
- abc.xyz
|
24
|
+
- homedepot.com
|
25
|
+
- bankofamerica.com
|
26
|
+
- express-scripts.com
|
27
|
+
- wellsfargo.com
|
28
|
+
- boeing.com
|
29
|
+
- phillips66.com
|
30
|
+
- antheminc.com
|
31
|
+
- microsoft.com
|
32
|
+
- valero.com
|
33
|
+
- citigroup.com
|
34
|
+
- comcastcorporation.com
|
35
|
+
- ibm.com
|
36
|
+
- delltechnologies.com
|
37
|
+
- statefarm.com
|
38
|
+
- jnj.com
|
39
|
+
- freddiemac.com
|
40
|
+
- target.com
|
41
|
+
- lowes.com
|
42
|
+
- marathonpetroleum.com
|
43
|
+
- pg.com
|
44
|
+
- metlife.com
|
45
|
+
- ups.com
|
46
|
+
- pepsico.com
|
47
|
+
- intel.com
|
48
|
+
- dow-dupont.com
|
49
|
+
- adm.com
|
50
|
+
- aetna.com
|
51
|
+
- fedex.com
|
52
|
+
- utc.com
|
53
|
+
- prudential.com
|
54
|
+
- albertsons.com
|
55
|
+
- sysco.com
|
56
|
+
- disney.com
|
57
|
+
- humana.com
|
58
|
+
- pfizer.com
|
59
|
+
- hp.com
|
60
|
+
- lockheedmartin.com
|
61
|
+
- aig.com
|
62
|
+
- centene.com
|
63
|
+
- cisco.com
|
64
|
+
- hcahealthcare.com
|
65
|
+
- energytransfer.com
|
66
|
+
- caterpillar.com
|
67
|
+
- nationwide.com
|
68
|
+
- morganstanley.com
|
69
|
+
- libertymutual.com
|
70
|
+
- newyorklife.com
|
71
|
+
- gs.com
|
72
|
+
- aa.com
|
73
|
+
- bestbuy.com
|
74
|
+
- cigna.com
|
75
|
+
- charter.com
|
76
|
+
- delta.com
|
77
|
+
- facebook.com
|
78
|
+
- honeywell.com
|
79
|
+
- merck.com
|
80
|
+
- allstate.com
|
81
|
+
- tysonfoods.com
|
82
|
+
- united.com
|
83
|
+
- oracle.com
|
84
|
+
- techdata.com
|
85
|
+
- tiaa.org
|
86
|
+
- tjx.com
|
87
|
+
- americanexpress.com
|
88
|
+
- coca-colacompany.com
|
89
|
+
- publix.com
|
90
|
+
- nike.com
|
91
|
+
- andeavor.com
|
92
|
+
- wfscorp.com
|
93
|
+
- exeloncorp.com
|
94
|
+
- massmutual.com
|
95
|
+
- riteaid.com
|
96
|
+
- conocophillips.com
|
97
|
+
- chsinc.com
|
98
|
+
- 3m.com
|
99
|
+
- timewarner.com
|
100
|
+
- generaldynamics.com
|
101
|
+
- usaa.com
|
data/lib/rogue_one/detector.rb
CHANGED
@@ -1,22 +1,37 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
+
require "async"
|
4
|
+
require "async/barrier"
|
5
|
+
require "async/dns"
|
6
|
+
require "async/reactor"
|
7
|
+
require "async/semaphore"
|
8
|
+
require "resolv"
|
3
9
|
require "yaml"
|
4
|
-
require "
|
10
|
+
require "etc"
|
5
11
|
|
6
12
|
module RogueOne
|
7
13
|
class Detector
|
8
|
-
attr_reader :target
|
9
|
-
attr_reader :custom_list
|
10
|
-
attr_reader :verbose
|
14
|
+
attr_reader :custom_list, :default_list, :max_concurrency, :record_type, :target, :verbose
|
11
15
|
|
12
16
|
GOOGLE_PUBLIC_DNS = "8.8.8.8"
|
13
17
|
|
14
|
-
def initialize(
|
18
|
+
def initialize(
|
19
|
+
target:,
|
20
|
+
custom_list: nil,
|
21
|
+
default_list: "alexa",
|
22
|
+
record_type: "A",
|
23
|
+
threshold: nil,
|
24
|
+
verbose: false
|
25
|
+
)
|
15
26
|
@target = target
|
27
|
+
|
16
28
|
@custom_list = custom_list
|
29
|
+
@default_list = default_list
|
30
|
+
@record_type = record_type.upcase.to_sym
|
17
31
|
@threshold = threshold
|
18
32
|
@verbose = verbose
|
19
33
|
|
34
|
+
@max_concurrency = Etc.nprocessors * 2
|
20
35
|
@memo = {}
|
21
36
|
@verbose_memo = nil
|
22
37
|
end
|
@@ -49,13 +64,16 @@ module RogueOne
|
|
49
64
|
def meta
|
50
65
|
return nil unless verbose
|
51
66
|
|
52
|
-
{
|
67
|
+
{
|
68
|
+
record_type: record_type,
|
69
|
+
threshold: threshold,
|
70
|
+
}
|
53
71
|
end
|
54
72
|
|
55
73
|
def landing_pages
|
56
|
-
@memo.
|
74
|
+
@memo.filter_map do |ip, count|
|
57
75
|
count > threshold ? ip : nil
|
58
|
-
end.
|
76
|
+
end.sort
|
59
77
|
end
|
60
78
|
|
61
79
|
def results
|
@@ -78,19 +96,28 @@ module RogueOne
|
|
78
96
|
def inspect
|
79
97
|
return unless @memo.empty?
|
80
98
|
|
81
|
-
|
82
|
-
|
83
|
-
target_result = target_resolver.get_resource(domain, "A")
|
99
|
+
# read domains outside of the async blocks
|
100
|
+
load_domains
|
84
101
|
|
85
|
-
|
86
|
-
|
102
|
+
normal_resolutions = bulk_resolve(normal_resolver, domains)
|
103
|
+
resolutions = bulk_resolve(target_resolver, domains)
|
87
104
|
|
88
|
-
|
105
|
+
results = resolutions.filter_map do |domain, addresses|
|
106
|
+
normal_addresses = normal_resolutions[domain] || []
|
107
|
+
address = (addresses || []).first
|
108
|
+
[domain, address] if address && !normal_addresses.include?(address)
|
109
|
+
end.to_h
|
110
|
+
|
111
|
+
@memo = results.values.group_by(&:itself).transform_values(&:length)
|
89
112
|
@verbose_memo = results if verbose
|
90
113
|
end
|
91
114
|
|
115
|
+
def load_domains
|
116
|
+
domains
|
117
|
+
end
|
118
|
+
|
92
119
|
def domains
|
93
|
-
@domains ||= custom_domains
|
120
|
+
@domains ||= custom_list ? custom_domains : top_100_domains
|
94
121
|
end
|
95
122
|
|
96
123
|
def custom_domains
|
@@ -98,20 +125,61 @@ module RogueOne
|
|
98
125
|
end
|
99
126
|
|
100
127
|
def top_100_domains
|
101
|
-
|
128
|
+
case default_list
|
129
|
+
when "alexa"
|
130
|
+
read_domains File.expand_path("./data/alexa_100.yml", __dir__)
|
131
|
+
when "fortune"
|
132
|
+
read_domains File.expand_path("./data/fortune_100.yml", __dir__)
|
133
|
+
end
|
102
134
|
end
|
103
135
|
|
104
136
|
def read_domains(path)
|
105
137
|
list = DomainList.new(path)
|
106
|
-
list.
|
138
|
+
return list.domains if list.valid?
|
139
|
+
|
140
|
+
raise ArgumentError, "Inputted an invalid list. #{path} does not eixst." unless list.exists?
|
141
|
+
raise ArgumentError, "Inputted an invalid list. Please input a list via a YAML file." unless list.valid_format?
|
142
|
+
end
|
143
|
+
|
144
|
+
def bulk_resolve(resolver, domains)
|
145
|
+
results = []
|
146
|
+
|
147
|
+
Async do
|
148
|
+
barrier = Async::Barrier.new
|
149
|
+
semaphore = Async::Semaphore.new(max_concurrency, parent: barrier)
|
150
|
+
|
151
|
+
domains.each do |domain|
|
152
|
+
semaphore.async do
|
153
|
+
addresses = []
|
154
|
+
begin
|
155
|
+
addresses = resolver.addresses_for(domain, dns_resource_by_record_type, { retries: 1 }).map(&:to_s)
|
156
|
+
rescue Async::DNS::ResolutionFailure
|
157
|
+
# do nothing
|
158
|
+
end
|
159
|
+
results << [domain, addresses]
|
160
|
+
end
|
161
|
+
end
|
162
|
+
end
|
163
|
+
results.to_h
|
107
164
|
end
|
108
165
|
|
109
166
|
def normal_resolver
|
110
|
-
|
167
|
+
Async::DNS::Resolver.new([[:udp, GOOGLE_PUBLIC_DNS, 53], [:tcp, GOOGLE_PUBLIC_DNS, 53]])
|
111
168
|
end
|
112
169
|
|
113
170
|
def target_resolver
|
114
|
-
|
171
|
+
Async::DNS::Resolver.new([[:udp, target, 53], [:tcp, target, 53]])
|
172
|
+
end
|
173
|
+
|
174
|
+
def dns_resource_by_record_type
|
175
|
+
@dns_resource_by_record_type ||= dns_resources[record_type]
|
176
|
+
end
|
177
|
+
|
178
|
+
def dns_resources
|
179
|
+
{
|
180
|
+
A: Resolv::DNS::Resource::IN::A,
|
181
|
+
AAAA: Resolv::DNS::Resource::IN::AAAA,
|
182
|
+
}
|
115
183
|
end
|
116
184
|
end
|
117
185
|
end
|
data/lib/rogue_one/ping.rb
CHANGED
@@ -1,16 +1,26 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
+
require "resolv"
|
4
|
+
|
3
5
|
module RogueOne
|
4
6
|
class Ping
|
5
|
-
attr_reader :resolver
|
7
|
+
attr_reader :resolver, :nameserver
|
6
8
|
|
7
9
|
def initialize(nameserver)
|
8
|
-
@
|
10
|
+
@nameserver = nameserver
|
11
|
+
@resolver = Resolv::DNS.new(nameserver: [nameserver])
|
12
|
+
@resolver.timeouts = 5
|
13
|
+
end
|
14
|
+
|
15
|
+
def get_a_record
|
16
|
+
resolver.getresource("example.com", Resolv::DNS::Resource::IN::A)
|
17
|
+
rescue Resolv::ResolvError => _e
|
18
|
+
nil
|
9
19
|
end
|
10
20
|
|
11
21
|
def pong?
|
12
|
-
result =
|
13
|
-
raise Error, "DNS resolve error: there is no resopnse from #{
|
22
|
+
result = get_a_record
|
23
|
+
raise Error, "DNS resolve error: there is no resopnse from #{nameserver}" unless result
|
14
24
|
|
15
25
|
true
|
16
26
|
end
|
data/lib/rogue_one/version.rb
CHANGED
data/lib/rogue_one.rb
CHANGED
data/rogue_one.gemspec
CHANGED
@@ -24,11 +24,11 @@ Gem::Specification.new do |spec|
|
|
24
24
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
25
25
|
spec.require_paths = ["lib"]
|
26
26
|
|
27
|
-
spec.add_development_dependency "bundler", "~> 2.
|
28
|
-
spec.add_development_dependency "
|
27
|
+
spec.add_development_dependency "bundler", "~> 2.2"
|
28
|
+
spec.add_development_dependency "coveralls_reborn", "~> 0.23"
|
29
29
|
spec.add_development_dependency "rake", "~> 13.0"
|
30
|
-
spec.add_development_dependency "rspec", "~> 3.
|
30
|
+
spec.add_development_dependency "rspec", "~> 3.10"
|
31
31
|
|
32
|
-
spec.add_dependency "
|
33
|
-
spec.add_dependency "thor", "~>
|
32
|
+
spec.add_dependency "async-dns", "~> 1.3"
|
33
|
+
spec.add_dependency "thor", "~> 1.1"
|
34
34
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rogue_one
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.3
|
4
|
+
version: 0.4.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-10-10 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -16,28 +16,28 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - "~>"
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: '2.
|
19
|
+
version: '2.2'
|
20
20
|
type: :development
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '2.
|
26
|
+
version: '2.2'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
|
-
name:
|
28
|
+
name: coveralls_reborn
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
30
30
|
requirements:
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version: '0.
|
33
|
+
version: '0.23'
|
34
34
|
type: :development
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - "~>"
|
39
39
|
- !ruby/object:Gem::Version
|
40
|
-
version: '0.
|
40
|
+
version: '0.23'
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
42
|
name: rake
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
@@ -58,42 +58,42 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - "~>"
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '3.
|
61
|
+
version: '3.10'
|
62
62
|
type: :development
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
66
|
- - "~>"
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: '3.
|
68
|
+
version: '3.10'
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
|
-
name:
|
70
|
+
name: async-dns
|
71
71
|
requirement: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
73
|
- - "~>"
|
74
74
|
- !ruby/object:Gem::Version
|
75
|
-
version: '1.
|
75
|
+
version: '1.3'
|
76
76
|
type: :runtime
|
77
77
|
prerelease: false
|
78
78
|
version_requirements: !ruby/object:Gem::Requirement
|
79
79
|
requirements:
|
80
80
|
- - "~>"
|
81
81
|
- !ruby/object:Gem::Version
|
82
|
-
version: '1.
|
82
|
+
version: '1.3'
|
83
83
|
- !ruby/object:Gem::Dependency
|
84
84
|
name: thor
|
85
85
|
requirement: !ruby/object:Gem::Requirement
|
86
86
|
requirements:
|
87
87
|
- - "~>"
|
88
88
|
- !ruby/object:Gem::Version
|
89
|
-
version: '
|
89
|
+
version: '1.1'
|
90
90
|
type: :runtime
|
91
91
|
prerelease: false
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
93
93
|
requirements:
|
94
94
|
- - "~>"
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version: '
|
96
|
+
version: '1.1'
|
97
97
|
description: A rogue DNS detector
|
98
98
|
email:
|
99
99
|
- manabu.niseki@gmail.com
|
@@ -102,9 +102,9 @@ executables:
|
|
102
102
|
extensions: []
|
103
103
|
extra_rdoc_files: []
|
104
104
|
files:
|
105
|
+
- ".github/workflows/test.yaml"
|
105
106
|
- ".gitignore"
|
106
107
|
- ".rspec"
|
107
|
-
- ".travis.yml"
|
108
108
|
- Gemfile
|
109
109
|
- LICENSE
|
110
110
|
- README.md
|
@@ -115,18 +115,19 @@ files:
|
|
115
115
|
- images/eyecatch.png
|
116
116
|
- lib/rogue_one.rb
|
117
117
|
- lib/rogue_one/cli.rb
|
118
|
-
- lib/rogue_one/data/
|
118
|
+
- lib/rogue_one/data/alexa_100.yml
|
119
|
+
- lib/rogue_one/data/fortune_100.yml
|
119
120
|
- lib/rogue_one/detector.rb
|
120
121
|
- lib/rogue_one/domain_list.rb
|
121
122
|
- lib/rogue_one/ping.rb
|
122
|
-
- lib/rogue_one/resolver.rb
|
123
123
|
- lib/rogue_one/version.rb
|
124
|
+
- renovate.json
|
124
125
|
- rogue_one.gemspec
|
125
126
|
homepage: https://github.com/ninoseki/rogue_one
|
126
127
|
licenses:
|
127
128
|
- MIT
|
128
129
|
metadata: {}
|
129
|
-
post_install_message:
|
130
|
+
post_install_message:
|
130
131
|
rdoc_options: []
|
131
132
|
require_paths:
|
132
133
|
- lib
|
@@ -141,8 +142,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
141
142
|
- !ruby/object:Gem::Version
|
142
143
|
version: '0'
|
143
144
|
requirements: []
|
144
|
-
rubygems_version: 3.
|
145
|
-
signing_key:
|
145
|
+
rubygems_version: 3.2.22
|
146
|
+
signing_key:
|
146
147
|
specification_version: 4
|
147
148
|
summary: A rogue DNS detector
|
148
149
|
test_files: []
|
data/.travis.yml
DELETED
@@ -1,101 +0,0 @@
|
|
1
|
-
---
|
2
|
-
- google.com
|
3
|
-
- facebook.com
|
4
|
-
- youtube.com
|
5
|
-
- yahoo.com
|
6
|
-
- baidu.com
|
7
|
-
- wikipedia.org
|
8
|
-
- qq.com
|
9
|
-
- taobao.com
|
10
|
-
- twitter.com
|
11
|
-
- amazon.com
|
12
|
-
- linkedin.com
|
13
|
-
- live.com
|
14
|
-
- google.co.in
|
15
|
-
- sina.com.cn
|
16
|
-
- hao123.com
|
17
|
-
- blogspot.com
|
18
|
-
- weibo.com
|
19
|
-
- tmall.com
|
20
|
-
- vk.com
|
21
|
-
- wordpress.com
|
22
|
-
- yahoo.co.jp
|
23
|
-
- sohu.com
|
24
|
-
- yandex.ru
|
25
|
-
- ebay.com
|
26
|
-
- google.de
|
27
|
-
- bing.com
|
28
|
-
- pinterest.com
|
29
|
-
- google.co.uk
|
30
|
-
- 163.com
|
31
|
-
- 360.cn
|
32
|
-
- google.fr
|
33
|
-
- ask.com
|
34
|
-
- instagram.com
|
35
|
-
- google.co.jp
|
36
|
-
- tumblr.com
|
37
|
-
- msn.com
|
38
|
-
- google.com.br
|
39
|
-
- mail.ru
|
40
|
-
- microsoft.com
|
41
|
-
- xvideos.com
|
42
|
-
- paypal.com
|
43
|
-
- google.ru
|
44
|
-
- soso.com
|
45
|
-
- adcash.com
|
46
|
-
- google.es
|
47
|
-
- google.it
|
48
|
-
- imdb.com
|
49
|
-
- apple.com
|
50
|
-
- imgur.com
|
51
|
-
- neobux.com
|
52
|
-
- craigslist.org
|
53
|
-
- amazon.co.jp
|
54
|
-
- t.co
|
55
|
-
- xhamster.com
|
56
|
-
- stackoverflow.com
|
57
|
-
- reddit.com
|
58
|
-
- google.com.mx
|
59
|
-
- google.com.hk
|
60
|
-
- cnn.com
|
61
|
-
- google.ca
|
62
|
-
- fc2.com
|
63
|
-
- go.com
|
64
|
-
- ifeng.com
|
65
|
-
- bbc.co.uk
|
66
|
-
- vube.com
|
67
|
-
- people.com.cn
|
68
|
-
- blogger.com
|
69
|
-
- aliexpress.com
|
70
|
-
- odnoklassniki.ru
|
71
|
-
- wordpress.org
|
72
|
-
- alibaba.com
|
73
|
-
- gmw.cn
|
74
|
-
- adobe.com
|
75
|
-
- huffingtonpost.com
|
76
|
-
- google.com.tr
|
77
|
-
- xinhuanet.com
|
78
|
-
- googleusercontent.com
|
79
|
-
- youku.com
|
80
|
-
- godaddy.com
|
81
|
-
- pornhub.com
|
82
|
-
- akamaihd.net
|
83
|
-
- thepiratebay.se
|
84
|
-
- kickass.to
|
85
|
-
- google.com.au
|
86
|
-
- amazon.de
|
87
|
-
- clkmon.com
|
88
|
-
- ebay.de
|
89
|
-
- alipay.com
|
90
|
-
- google.pl
|
91
|
-
- espn.go.com
|
92
|
-
- dailymotion.com
|
93
|
-
- about.com
|
94
|
-
- bp.blogspot.com
|
95
|
-
- blogspot.in
|
96
|
-
- netflix.com
|
97
|
-
- vimeo.com
|
98
|
-
- dailymail.co.uk
|
99
|
-
- redtube.com
|
100
|
-
- rakuten.co.jp
|
101
|
-
- conduit.com
|
data/lib/rogue_one/resolver.rb
DELETED
@@ -1,55 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "resolv"
|
4
|
-
|
5
|
-
module RogueOne
|
6
|
-
class Resolver
|
7
|
-
attr_reader :nameserver
|
8
|
-
|
9
|
-
def initialize(nameserver:)
|
10
|
-
@nameserver = nameserver
|
11
|
-
end
|
12
|
-
|
13
|
-
def get_resource(domain, type)
|
14
|
-
_resolver.getresource(domain, resource_by_type(type)).address.to_s
|
15
|
-
rescue Resolv::ResolvError => _e
|
16
|
-
nil
|
17
|
-
end
|
18
|
-
|
19
|
-
def get_resources(domain, type)
|
20
|
-
_resolver.getresources(domain, resource_by_type(type)).map { |r| r.address.to_s }
|
21
|
-
rescue Resolv::ResolvError => _e
|
22
|
-
nil
|
23
|
-
end
|
24
|
-
|
25
|
-
private
|
26
|
-
|
27
|
-
def _resolver
|
28
|
-
@_resolver ||= Resolv::DNS.new(nameserver: [nameserver])
|
29
|
-
@_resolver.timeouts = 5
|
30
|
-
@_resolver
|
31
|
-
end
|
32
|
-
|
33
|
-
def resource_by_type(type)
|
34
|
-
resources.dig(type.upcase.to_sym)
|
35
|
-
end
|
36
|
-
|
37
|
-
def resources
|
38
|
-
{
|
39
|
-
ANY: Resolv::DNS::Resource::IN::ANY,
|
40
|
-
NS: Resolv::DNS::Resource::IN::NS,
|
41
|
-
CNAME: Resolv::DNS::Resource::IN::CNAME,
|
42
|
-
SOA: Resolv::DNS::Resource::IN::SOA,
|
43
|
-
HINFO: Resolv::DNS::Resource::IN::HINFO,
|
44
|
-
MINFO: Resolv::DNS::Resource::IN::MINFO,
|
45
|
-
MX: Resolv::DNS::Resource::IN::MX,
|
46
|
-
TXT: Resolv::DNS::Resource::IN::TXT,
|
47
|
-
A: Resolv::DNS::Resource::IN::A,
|
48
|
-
WKS: Resolv::DNS::Resource::IN::WKS,
|
49
|
-
PTR: Resolv::DNS::Resource::IN::PTR,
|
50
|
-
AAAA: Resolv::DNS::Resource::IN::AAAA,
|
51
|
-
SRV: Resolv::DNS::Resource::IN::SRV,
|
52
|
-
}
|
53
|
-
end
|
54
|
-
end
|
55
|
-
end
|