rogue_one 0.3.0 → 0.4.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/test.yaml +23 -0
- data/Gemfile +2 -0
- data/README.md +9 -5
- data/Rakefile +3 -1
- data/bin/console +1 -0
- data/exe/rogue_one +3 -1
- data/lib/rogue_one/cli.rb +20 -1
- data/lib/rogue_one/data/alexa_100.yml +101 -0
- data/lib/rogue_one/data/fortune_100.yml +101 -0
- data/lib/rogue_one/detector.rb +87 -19
- data/lib/rogue_one/domain_list.rb +0 -2
- data/lib/rogue_one/ping.rb +14 -4
- data/lib/rogue_one/version.rb +1 -1
- data/lib/rogue_one.rb +0 -1
- data/renovate.json +5 -0
- data/rogue_one.gemspec +5 -5
- metadata +22 -21
- data/.travis.yml +0 -7
- data/lib/rogue_one/data/top_100.yml +0 -101
- data/lib/rogue_one/resolver.rb +0 -55
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b93f5fd8739dbb15739809bba1f391a913d5e7e3a8822a07487f9942ee307ac6
|
4
|
+
data.tar.gz: c413a952f102a75f3bbf7db003373eebe1ecd8b0f92c52db345dbda3d562bff1
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 477c391a0c54c2889ff000048c24952355e2e9c26116a68c7748e6e64d16ca0657264c81a6ce6c56d2251c5d830c8075efd81ccfb3a6151d03914e083927c9a3
|
7
|
+
data.tar.gz: 3c4ebc1b64c51d0299c969363fd5d51223f4ef21912c4957ac8d8db1666295f3f070919674687935d48f2e45334f7d4e66fabb96ef4a39e36ef0a7b56c9f903e
|
@@ -0,0 +1,23 @@
|
|
1
|
+
name: Ruby CI
|
2
|
+
|
3
|
+
on: [pull_request]
|
4
|
+
|
5
|
+
jobs:
|
6
|
+
build:
|
7
|
+
runs-on: ubuntu-latest
|
8
|
+
|
9
|
+
strategy:
|
10
|
+
fail-fast: false
|
11
|
+
matrix:
|
12
|
+
ruby: [2.7, "3.0"]
|
13
|
+
|
14
|
+
steps:
|
15
|
+
- uses: actions/checkout@v2
|
16
|
+
- name: Set up Ruby
|
17
|
+
uses: ruby/setup-ruby@v1
|
18
|
+
with:
|
19
|
+
ruby-version: ${{ matrix.ruby }}
|
20
|
+
bundler-cache: true
|
21
|
+
- name: Build and test with Rake
|
22
|
+
run: |
|
23
|
+
bundle exec rake
|
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# Rogue one
|
2
2
|
|
3
3
|
[](https://badge.fury.io/rb/rogue_one)
|
4
|
-
[](https://github.com/ninoseki/rogue_one/actions/workflows/test.yaml)
|
5
5
|
[](https://www.codefactor.io/repository/github/ninoseki/rogue_one)
|
6
6
|
[](https://coveralls.io/github/ninoseki/rogue_one?branch=master)
|
7
7
|
|
@@ -39,8 +39,12 @@ Usage:
|
|
39
39
|
rogue_one report [DNS_SERVER]
|
40
40
|
|
41
41
|
Options:
|
42
|
-
[--custom-list=CUSTOM_LIST]
|
43
|
-
[--
|
42
|
+
[--custom-list=CUSTOM_LIST] # A path to a custom list of domains
|
43
|
+
[--default-list=DEFAULT_LIST] # A default list of top 100 domains (Alexa or Fortune)
|
44
|
+
# Default: alexa
|
45
|
+
[--record-type=RECORD_TYPE] # A type of the DNS resource to check
|
46
|
+
# Default: A
|
47
|
+
[--threshold=N] # Threshold value for determining malicious or not
|
44
48
|
[--verbose], [--no-verbose]
|
45
49
|
|
46
50
|
Show a report of a given DNS server
|
@@ -71,11 +75,11 @@ $ rogue_one report 171.244.3.111 --custom-list tmp/roaming.yml
|
|
71
75
|
"58.82.243.9"
|
72
76
|
]
|
73
77
|
}
|
74
|
-
# Note: a custom list should be an array of domains in YAML
|
78
|
+
# Note: a custom list should be an array of domains in a YAML file.
|
75
79
|
```
|
76
80
|
|
77
81
|
| Key | Desc. |
|
78
|
-
|
82
|
+
|---------------|--------------------------------------------------------------------------|
|
79
83
|
| verdict | A detection result (`rogue one` or `benign one`) |
|
80
84
|
| landing_pages | An array of IP of landing pages |
|
81
85
|
| results | DNS resolution results (only available if --verbose option is specified) |
|
data/Rakefile
CHANGED
data/bin/console
CHANGED
data/exe/rogue_one
CHANGED
data/lib/rogue_one/cli.rb
CHANGED
@@ -5,8 +5,16 @@ require "json"
|
|
5
5
|
|
6
6
|
module RogueOne
|
7
7
|
class CLI < Thor
|
8
|
+
class << self
|
9
|
+
def exit_on_failure?
|
10
|
+
true
|
11
|
+
end
|
12
|
+
end
|
13
|
+
|
8
14
|
desc "report [DNS_SERVER]", "Show a report of a given DNS server"
|
9
15
|
method_option :custom_list, type: :string, desc: "A path to a custom list of domains"
|
16
|
+
method_option :default_list, type: :string, default: "alexa", desc: "A default list of top 100 domains (Alexa or Fortune)"
|
17
|
+
method_option :record_type, type: :string, default: "A", desc: "A type of the DNS resource to check"
|
10
18
|
method_option :threshold, type: :numeric, desc: "Threshold value for determining malicious or not"
|
11
19
|
method_option :verbose, type: :boolean
|
12
20
|
def report(dns_server)
|
@@ -14,12 +22,23 @@ module RogueOne
|
|
14
22
|
Ping.pong? dns_server
|
15
23
|
|
16
24
|
custom_list = options["custom_list"]
|
25
|
+
default_list = options["default_list"].downcase
|
26
|
+
record_type = options["record_type"].upcase
|
17
27
|
threshold = options["threshold"]
|
18
28
|
verbose = options["verbose"]
|
19
|
-
|
29
|
+
|
30
|
+
detector = Detector.new(
|
31
|
+
custom_list: custom_list,
|
32
|
+
default_list: default_list,
|
33
|
+
record_type: record_type,
|
34
|
+
target: dns_server,
|
35
|
+
threshold: threshold,
|
36
|
+
verbose: verbose,
|
37
|
+
)
|
20
38
|
puts JSON.pretty_generate(detector.report)
|
21
39
|
end
|
22
40
|
end
|
41
|
+
default_command :report
|
23
42
|
|
24
43
|
no_commands do
|
25
44
|
def with_error_handling
|
@@ -0,0 +1,101 @@
|
|
1
|
+
---
|
2
|
+
- google.com
|
3
|
+
- youtube.com
|
4
|
+
- tmall.com
|
5
|
+
- baidu.com
|
6
|
+
- qq.com
|
7
|
+
- sohu.com
|
8
|
+
- facebook.com
|
9
|
+
- login.tmall.com
|
10
|
+
- wikipedia.org
|
11
|
+
- taobao.com
|
12
|
+
- yahoo.com
|
13
|
+
- jd.com
|
14
|
+
- 360.cn
|
15
|
+
- amazon.com
|
16
|
+
- sina.com.cn
|
17
|
+
- weibo.com
|
18
|
+
- pages.tmall.com
|
19
|
+
- reddit.com
|
20
|
+
- live.com
|
21
|
+
- vk.com
|
22
|
+
- okezone.com
|
23
|
+
- netflix.com
|
24
|
+
- blogspot.com
|
25
|
+
- office.com
|
26
|
+
- csdn.net
|
27
|
+
- alipay.com
|
28
|
+
- xinhuanet.com
|
29
|
+
- stackoverflow.com
|
30
|
+
- yahoo.co.jp
|
31
|
+
- instagram.com
|
32
|
+
- google.com.hk
|
33
|
+
- aliexpress.com
|
34
|
+
- microsoft.com
|
35
|
+
- babytree.com
|
36
|
+
- naver.com
|
37
|
+
- twitter.com
|
38
|
+
- bing.com
|
39
|
+
- livejasmin.com
|
40
|
+
- amazon.co.jp
|
41
|
+
- tribunnews.com
|
42
|
+
- ebay.com
|
43
|
+
- salesforce.com
|
44
|
+
- twitch.tv
|
45
|
+
- google.co.in
|
46
|
+
- force.com
|
47
|
+
- microsoftonline.com
|
48
|
+
- apple.com
|
49
|
+
- tianya.cn
|
50
|
+
- adobe.com
|
51
|
+
- pornhub.com
|
52
|
+
- msn.com
|
53
|
+
- zhanqi.tv
|
54
|
+
- dropbox.com
|
55
|
+
- linkedin.com
|
56
|
+
- yandex.ru
|
57
|
+
- wordpress.com
|
58
|
+
- myshopify.com
|
59
|
+
- amazon.in
|
60
|
+
- mail.ru
|
61
|
+
- panda.tv
|
62
|
+
- imdb.com
|
63
|
+
- caijing.com.cn
|
64
|
+
- china.com.cn
|
65
|
+
- mama.cn
|
66
|
+
- amazonaws.com
|
67
|
+
- google.com.br
|
68
|
+
- trello.com
|
69
|
+
- bongacams.com
|
70
|
+
- google.de
|
71
|
+
- medium.com
|
72
|
+
- google.co.jp
|
73
|
+
- soso.com
|
74
|
+
- booking.com
|
75
|
+
- w3schools.com
|
76
|
+
- amazon.co.uk
|
77
|
+
- spotify.com
|
78
|
+
- amazon.de
|
79
|
+
- rednet.cn
|
80
|
+
- bbc.com
|
81
|
+
- detail.tmall.com
|
82
|
+
- xvideos.com
|
83
|
+
- espn.com
|
84
|
+
- detik.com
|
85
|
+
- github.com
|
86
|
+
- cnn.com
|
87
|
+
- instructure.com
|
88
|
+
- ok.ru
|
89
|
+
- indeed.com
|
90
|
+
- yy.com
|
91
|
+
- tumblr.com
|
92
|
+
- huanqiu.com
|
93
|
+
- stackexchange.com
|
94
|
+
- nytimes.com
|
95
|
+
- imgur.com
|
96
|
+
- soundcloud.com
|
97
|
+
- whatsapp.com
|
98
|
+
- rakuten.co.jp
|
99
|
+
- nih.gov
|
100
|
+
- sogou.com
|
101
|
+
- google.cn
|
@@ -0,0 +1,101 @@
|
|
1
|
+
---
|
2
|
+
- walmart.com
|
3
|
+
- exxonmobil.com
|
4
|
+
- berkshirehathaway.com
|
5
|
+
- apple.com
|
6
|
+
- unitedhealthgroup.com
|
7
|
+
- mckesson.com
|
8
|
+
- cvshealth.com
|
9
|
+
- amazon.com
|
10
|
+
- att.com
|
11
|
+
- gm.com
|
12
|
+
- ford.com
|
13
|
+
- amerisourcebergen.com
|
14
|
+
- chevron.com
|
15
|
+
- cardinalhealth.com
|
16
|
+
- costco.com
|
17
|
+
- verizon.com
|
18
|
+
- kroger.com
|
19
|
+
- ge.com
|
20
|
+
- walgreensbootsalliance.com
|
21
|
+
- jpmorganchase.com
|
22
|
+
- fanniemae.com
|
23
|
+
- abc.xyz
|
24
|
+
- homedepot.com
|
25
|
+
- bankofamerica.com
|
26
|
+
- express-scripts.com
|
27
|
+
- wellsfargo.com
|
28
|
+
- boeing.com
|
29
|
+
- phillips66.com
|
30
|
+
- antheminc.com
|
31
|
+
- microsoft.com
|
32
|
+
- valero.com
|
33
|
+
- citigroup.com
|
34
|
+
- comcastcorporation.com
|
35
|
+
- ibm.com
|
36
|
+
- delltechnologies.com
|
37
|
+
- statefarm.com
|
38
|
+
- jnj.com
|
39
|
+
- freddiemac.com
|
40
|
+
- target.com
|
41
|
+
- lowes.com
|
42
|
+
- marathonpetroleum.com
|
43
|
+
- pg.com
|
44
|
+
- metlife.com
|
45
|
+
- ups.com
|
46
|
+
- pepsico.com
|
47
|
+
- intel.com
|
48
|
+
- dow-dupont.com
|
49
|
+
- adm.com
|
50
|
+
- aetna.com
|
51
|
+
- fedex.com
|
52
|
+
- utc.com
|
53
|
+
- prudential.com
|
54
|
+
- albertsons.com
|
55
|
+
- sysco.com
|
56
|
+
- disney.com
|
57
|
+
- humana.com
|
58
|
+
- pfizer.com
|
59
|
+
- hp.com
|
60
|
+
- lockheedmartin.com
|
61
|
+
- aig.com
|
62
|
+
- centene.com
|
63
|
+
- cisco.com
|
64
|
+
- hcahealthcare.com
|
65
|
+
- energytransfer.com
|
66
|
+
- caterpillar.com
|
67
|
+
- nationwide.com
|
68
|
+
- morganstanley.com
|
69
|
+
- libertymutual.com
|
70
|
+
- newyorklife.com
|
71
|
+
- gs.com
|
72
|
+
- aa.com
|
73
|
+
- bestbuy.com
|
74
|
+
- cigna.com
|
75
|
+
- charter.com
|
76
|
+
- delta.com
|
77
|
+
- facebook.com
|
78
|
+
- honeywell.com
|
79
|
+
- merck.com
|
80
|
+
- allstate.com
|
81
|
+
- tysonfoods.com
|
82
|
+
- united.com
|
83
|
+
- oracle.com
|
84
|
+
- techdata.com
|
85
|
+
- tiaa.org
|
86
|
+
- tjx.com
|
87
|
+
- americanexpress.com
|
88
|
+
- coca-colacompany.com
|
89
|
+
- publix.com
|
90
|
+
- nike.com
|
91
|
+
- andeavor.com
|
92
|
+
- wfscorp.com
|
93
|
+
- exeloncorp.com
|
94
|
+
- massmutual.com
|
95
|
+
- riteaid.com
|
96
|
+
- conocophillips.com
|
97
|
+
- chsinc.com
|
98
|
+
- 3m.com
|
99
|
+
- timewarner.com
|
100
|
+
- generaldynamics.com
|
101
|
+
- usaa.com
|
data/lib/rogue_one/detector.rb
CHANGED
@@ -1,22 +1,37 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
+
require "async"
|
4
|
+
require "async/barrier"
|
5
|
+
require "async/dns"
|
6
|
+
require "async/reactor"
|
7
|
+
require "async/semaphore"
|
8
|
+
require "resolv"
|
3
9
|
require "yaml"
|
4
|
-
require "
|
10
|
+
require "etc"
|
5
11
|
|
6
12
|
module RogueOne
|
7
13
|
class Detector
|
8
|
-
attr_reader :target
|
9
|
-
attr_reader :custom_list
|
10
|
-
attr_reader :verbose
|
14
|
+
attr_reader :custom_list, :default_list, :max_concurrency, :record_type, :target, :verbose
|
11
15
|
|
12
16
|
GOOGLE_PUBLIC_DNS = "8.8.8.8"
|
13
17
|
|
14
|
-
def initialize(
|
18
|
+
def initialize(
|
19
|
+
target:,
|
20
|
+
custom_list: nil,
|
21
|
+
default_list: "alexa",
|
22
|
+
record_type: "A",
|
23
|
+
threshold: nil,
|
24
|
+
verbose: false
|
25
|
+
)
|
15
26
|
@target = target
|
27
|
+
|
16
28
|
@custom_list = custom_list
|
29
|
+
@default_list = default_list
|
30
|
+
@record_type = record_type.upcase.to_sym
|
17
31
|
@threshold = threshold
|
18
32
|
@verbose = verbose
|
19
33
|
|
34
|
+
@max_concurrency = Etc.nprocessors * 2
|
20
35
|
@memo = {}
|
21
36
|
@verbose_memo = nil
|
22
37
|
end
|
@@ -49,13 +64,16 @@ module RogueOne
|
|
49
64
|
def meta
|
50
65
|
return nil unless verbose
|
51
66
|
|
52
|
-
{
|
67
|
+
{
|
68
|
+
record_type: record_type,
|
69
|
+
threshold: threshold,
|
70
|
+
}
|
53
71
|
end
|
54
72
|
|
55
73
|
def landing_pages
|
56
|
-
@memo.
|
74
|
+
@memo.filter_map do |ip, count|
|
57
75
|
count > threshold ? ip : nil
|
58
|
-
end.
|
76
|
+
end.sort
|
59
77
|
end
|
60
78
|
|
61
79
|
def results
|
@@ -78,19 +96,28 @@ module RogueOne
|
|
78
96
|
def inspect
|
79
97
|
return unless @memo.empty?
|
80
98
|
|
81
|
-
|
82
|
-
|
83
|
-
target_result = target_resolver.get_resource(domain, "A")
|
99
|
+
# read domains outside of the async blocks
|
100
|
+
load_domains
|
84
101
|
|
85
|
-
|
86
|
-
|
102
|
+
normal_resolutions = bulk_resolve(normal_resolver, domains)
|
103
|
+
resolutions = bulk_resolve(target_resolver, domains)
|
87
104
|
|
88
|
-
|
105
|
+
results = resolutions.filter_map do |domain, addresses|
|
106
|
+
normal_addresses = normal_resolutions[domain] || []
|
107
|
+
address = (addresses || []).first
|
108
|
+
[domain, address] if address && !normal_addresses.include?(address)
|
109
|
+
end.to_h
|
110
|
+
|
111
|
+
@memo = results.values.group_by(&:itself).transform_values(&:length)
|
89
112
|
@verbose_memo = results if verbose
|
90
113
|
end
|
91
114
|
|
115
|
+
def load_domains
|
116
|
+
domains
|
117
|
+
end
|
118
|
+
|
92
119
|
def domains
|
93
|
-
@domains ||= custom_domains
|
120
|
+
@domains ||= custom_list ? custom_domains : top_100_domains
|
94
121
|
end
|
95
122
|
|
96
123
|
def custom_domains
|
@@ -98,20 +125,61 @@ module RogueOne
|
|
98
125
|
end
|
99
126
|
|
100
127
|
def top_100_domains
|
101
|
-
|
128
|
+
case default_list
|
129
|
+
when "alexa"
|
130
|
+
read_domains File.expand_path("./data/alexa_100.yml", __dir__)
|
131
|
+
when "fortune"
|
132
|
+
read_domains File.expand_path("./data/fortune_100.yml", __dir__)
|
133
|
+
end
|
102
134
|
end
|
103
135
|
|
104
136
|
def read_domains(path)
|
105
137
|
list = DomainList.new(path)
|
106
|
-
list.
|
138
|
+
return list.domains if list.valid?
|
139
|
+
|
140
|
+
raise ArgumentError, "Inputted an invalid list. #{path} does not eixst." unless list.exists?
|
141
|
+
raise ArgumentError, "Inputted an invalid list. Please input a list via a YAML file." unless list.valid_format?
|
142
|
+
end
|
143
|
+
|
144
|
+
def bulk_resolve(resolver, domains)
|
145
|
+
results = []
|
146
|
+
|
147
|
+
Async do
|
148
|
+
barrier = Async::Barrier.new
|
149
|
+
semaphore = Async::Semaphore.new(max_concurrency, parent: barrier)
|
150
|
+
|
151
|
+
domains.each do |domain|
|
152
|
+
semaphore.async do
|
153
|
+
addresses = []
|
154
|
+
begin
|
155
|
+
addresses = resolver.addresses_for(domain, dns_resource_by_record_type, { retries: 1 }).map(&:to_s)
|
156
|
+
rescue Async::DNS::ResolutionFailure
|
157
|
+
# do nothing
|
158
|
+
end
|
159
|
+
results << [domain, addresses]
|
160
|
+
end
|
161
|
+
end
|
162
|
+
end
|
163
|
+
results.to_h
|
107
164
|
end
|
108
165
|
|
109
166
|
def normal_resolver
|
110
|
-
|
167
|
+
Async::DNS::Resolver.new([[:udp, GOOGLE_PUBLIC_DNS, 53], [:tcp, GOOGLE_PUBLIC_DNS, 53]])
|
111
168
|
end
|
112
169
|
|
113
170
|
def target_resolver
|
114
|
-
|
171
|
+
Async::DNS::Resolver.new([[:udp, target, 53], [:tcp, target, 53]])
|
172
|
+
end
|
173
|
+
|
174
|
+
def dns_resource_by_record_type
|
175
|
+
@dns_resource_by_record_type ||= dns_resources[record_type]
|
176
|
+
end
|
177
|
+
|
178
|
+
def dns_resources
|
179
|
+
{
|
180
|
+
A: Resolv::DNS::Resource::IN::A,
|
181
|
+
AAAA: Resolv::DNS::Resource::IN::AAAA,
|
182
|
+
}
|
115
183
|
end
|
116
184
|
end
|
117
185
|
end
|
data/lib/rogue_one/ping.rb
CHANGED
@@ -1,16 +1,26 @@
|
|
1
1
|
# frozen_string_literal: true
|
2
2
|
|
3
|
+
require "resolv"
|
4
|
+
|
3
5
|
module RogueOne
|
4
6
|
class Ping
|
5
|
-
attr_reader :resolver
|
7
|
+
attr_reader :resolver, :nameserver
|
6
8
|
|
7
9
|
def initialize(nameserver)
|
8
|
-
@
|
10
|
+
@nameserver = nameserver
|
11
|
+
@resolver = Resolv::DNS.new(nameserver: [nameserver])
|
12
|
+
@resolver.timeouts = 5
|
13
|
+
end
|
14
|
+
|
15
|
+
def get_a_record
|
16
|
+
resolver.getresource("example.com", Resolv::DNS::Resource::IN::A)
|
17
|
+
rescue Resolv::ResolvError => _e
|
18
|
+
nil
|
9
19
|
end
|
10
20
|
|
11
21
|
def pong?
|
12
|
-
result =
|
13
|
-
raise Error, "DNS resolve error: there is no resopnse from #{
|
22
|
+
result = get_a_record
|
23
|
+
raise Error, "DNS resolve error: there is no resopnse from #{nameserver}" unless result
|
14
24
|
|
15
25
|
true
|
16
26
|
end
|
data/lib/rogue_one/version.rb
CHANGED
data/lib/rogue_one.rb
CHANGED
data/rogue_one.gemspec
CHANGED
@@ -24,11 +24,11 @@ Gem::Specification.new do |spec|
|
|
24
24
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
25
25
|
spec.require_paths = ["lib"]
|
26
26
|
|
27
|
-
spec.add_development_dependency "bundler", "~> 2.
|
28
|
-
spec.add_development_dependency "
|
27
|
+
spec.add_development_dependency "bundler", "~> 2.2"
|
28
|
+
spec.add_development_dependency "coveralls_reborn", "~> 0.23"
|
29
29
|
spec.add_development_dependency "rake", "~> 13.0"
|
30
|
-
spec.add_development_dependency "rspec", "~> 3.
|
30
|
+
spec.add_development_dependency "rspec", "~> 3.10"
|
31
31
|
|
32
|
-
spec.add_dependency "
|
33
|
-
spec.add_dependency "thor", "~>
|
32
|
+
spec.add_dependency "async-dns", "~> 1.3"
|
33
|
+
spec.add_dependency "thor", "~> 1.1"
|
34
34
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rogue_one
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.3
|
4
|
+
version: 0.4.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-10-10 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -16,28 +16,28 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - "~>"
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: '2.
|
19
|
+
version: '2.2'
|
20
20
|
type: :development
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '2.
|
26
|
+
version: '2.2'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
|
-
name:
|
28
|
+
name: coveralls_reborn
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
30
30
|
requirements:
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version: '0.
|
33
|
+
version: '0.23'
|
34
34
|
type: :development
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - "~>"
|
39
39
|
- !ruby/object:Gem::Version
|
40
|
-
version: '0.
|
40
|
+
version: '0.23'
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
42
|
name: rake
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
@@ -58,42 +58,42 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - "~>"
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '3.
|
61
|
+
version: '3.10'
|
62
62
|
type: :development
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
66
|
- - "~>"
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: '3.
|
68
|
+
version: '3.10'
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
|
-
name:
|
70
|
+
name: async-dns
|
71
71
|
requirement: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
73
|
- - "~>"
|
74
74
|
- !ruby/object:Gem::Version
|
75
|
-
version: '1.
|
75
|
+
version: '1.3'
|
76
76
|
type: :runtime
|
77
77
|
prerelease: false
|
78
78
|
version_requirements: !ruby/object:Gem::Requirement
|
79
79
|
requirements:
|
80
80
|
- - "~>"
|
81
81
|
- !ruby/object:Gem::Version
|
82
|
-
version: '1.
|
82
|
+
version: '1.3'
|
83
83
|
- !ruby/object:Gem::Dependency
|
84
84
|
name: thor
|
85
85
|
requirement: !ruby/object:Gem::Requirement
|
86
86
|
requirements:
|
87
87
|
- - "~>"
|
88
88
|
- !ruby/object:Gem::Version
|
89
|
-
version: '
|
89
|
+
version: '1.1'
|
90
90
|
type: :runtime
|
91
91
|
prerelease: false
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
93
93
|
requirements:
|
94
94
|
- - "~>"
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version: '
|
96
|
+
version: '1.1'
|
97
97
|
description: A rogue DNS detector
|
98
98
|
email:
|
99
99
|
- manabu.niseki@gmail.com
|
@@ -102,9 +102,9 @@ executables:
|
|
102
102
|
extensions: []
|
103
103
|
extra_rdoc_files: []
|
104
104
|
files:
|
105
|
+
- ".github/workflows/test.yaml"
|
105
106
|
- ".gitignore"
|
106
107
|
- ".rspec"
|
107
|
-
- ".travis.yml"
|
108
108
|
- Gemfile
|
109
109
|
- LICENSE
|
110
110
|
- README.md
|
@@ -115,18 +115,19 @@ files:
|
|
115
115
|
- images/eyecatch.png
|
116
116
|
- lib/rogue_one.rb
|
117
117
|
- lib/rogue_one/cli.rb
|
118
|
-
- lib/rogue_one/data/
|
118
|
+
- lib/rogue_one/data/alexa_100.yml
|
119
|
+
- lib/rogue_one/data/fortune_100.yml
|
119
120
|
- lib/rogue_one/detector.rb
|
120
121
|
- lib/rogue_one/domain_list.rb
|
121
122
|
- lib/rogue_one/ping.rb
|
122
|
-
- lib/rogue_one/resolver.rb
|
123
123
|
- lib/rogue_one/version.rb
|
124
|
+
- renovate.json
|
124
125
|
- rogue_one.gemspec
|
125
126
|
homepage: https://github.com/ninoseki/rogue_one
|
126
127
|
licenses:
|
127
128
|
- MIT
|
128
129
|
metadata: {}
|
129
|
-
post_install_message:
|
130
|
+
post_install_message:
|
130
131
|
rdoc_options: []
|
131
132
|
require_paths:
|
132
133
|
- lib
|
@@ -141,8 +142,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
141
142
|
- !ruby/object:Gem::Version
|
142
143
|
version: '0'
|
143
144
|
requirements: []
|
144
|
-
rubygems_version: 3.
|
145
|
-
signing_key:
|
145
|
+
rubygems_version: 3.2.22
|
146
|
+
signing_key:
|
146
147
|
specification_version: 4
|
147
148
|
summary: A rogue DNS detector
|
148
149
|
test_files: []
|
data/.travis.yml
DELETED
@@ -1,101 +0,0 @@
|
|
1
|
-
---
|
2
|
-
- google.com
|
3
|
-
- facebook.com
|
4
|
-
- youtube.com
|
5
|
-
- yahoo.com
|
6
|
-
- baidu.com
|
7
|
-
- wikipedia.org
|
8
|
-
- qq.com
|
9
|
-
- taobao.com
|
10
|
-
- twitter.com
|
11
|
-
- amazon.com
|
12
|
-
- linkedin.com
|
13
|
-
- live.com
|
14
|
-
- google.co.in
|
15
|
-
- sina.com.cn
|
16
|
-
- hao123.com
|
17
|
-
- blogspot.com
|
18
|
-
- weibo.com
|
19
|
-
- tmall.com
|
20
|
-
- vk.com
|
21
|
-
- wordpress.com
|
22
|
-
- yahoo.co.jp
|
23
|
-
- sohu.com
|
24
|
-
- yandex.ru
|
25
|
-
- ebay.com
|
26
|
-
- google.de
|
27
|
-
- bing.com
|
28
|
-
- pinterest.com
|
29
|
-
- google.co.uk
|
30
|
-
- 163.com
|
31
|
-
- 360.cn
|
32
|
-
- google.fr
|
33
|
-
- ask.com
|
34
|
-
- instagram.com
|
35
|
-
- google.co.jp
|
36
|
-
- tumblr.com
|
37
|
-
- msn.com
|
38
|
-
- google.com.br
|
39
|
-
- mail.ru
|
40
|
-
- microsoft.com
|
41
|
-
- xvideos.com
|
42
|
-
- paypal.com
|
43
|
-
- google.ru
|
44
|
-
- soso.com
|
45
|
-
- adcash.com
|
46
|
-
- google.es
|
47
|
-
- google.it
|
48
|
-
- imdb.com
|
49
|
-
- apple.com
|
50
|
-
- imgur.com
|
51
|
-
- neobux.com
|
52
|
-
- craigslist.org
|
53
|
-
- amazon.co.jp
|
54
|
-
- t.co
|
55
|
-
- xhamster.com
|
56
|
-
- stackoverflow.com
|
57
|
-
- reddit.com
|
58
|
-
- google.com.mx
|
59
|
-
- google.com.hk
|
60
|
-
- cnn.com
|
61
|
-
- google.ca
|
62
|
-
- fc2.com
|
63
|
-
- go.com
|
64
|
-
- ifeng.com
|
65
|
-
- bbc.co.uk
|
66
|
-
- vube.com
|
67
|
-
- people.com.cn
|
68
|
-
- blogger.com
|
69
|
-
- aliexpress.com
|
70
|
-
- odnoklassniki.ru
|
71
|
-
- wordpress.org
|
72
|
-
- alibaba.com
|
73
|
-
- gmw.cn
|
74
|
-
- adobe.com
|
75
|
-
- huffingtonpost.com
|
76
|
-
- google.com.tr
|
77
|
-
- xinhuanet.com
|
78
|
-
- googleusercontent.com
|
79
|
-
- youku.com
|
80
|
-
- godaddy.com
|
81
|
-
- pornhub.com
|
82
|
-
- akamaihd.net
|
83
|
-
- thepiratebay.se
|
84
|
-
- kickass.to
|
85
|
-
- google.com.au
|
86
|
-
- amazon.de
|
87
|
-
- clkmon.com
|
88
|
-
- ebay.de
|
89
|
-
- alipay.com
|
90
|
-
- google.pl
|
91
|
-
- espn.go.com
|
92
|
-
- dailymotion.com
|
93
|
-
- about.com
|
94
|
-
- bp.blogspot.com
|
95
|
-
- blogspot.in
|
96
|
-
- netflix.com
|
97
|
-
- vimeo.com
|
98
|
-
- dailymail.co.uk
|
99
|
-
- redtube.com
|
100
|
-
- rakuten.co.jp
|
101
|
-
- conduit.com
|
data/lib/rogue_one/resolver.rb
DELETED
@@ -1,55 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "resolv"
|
4
|
-
|
5
|
-
module RogueOne
|
6
|
-
class Resolver
|
7
|
-
attr_reader :nameserver
|
8
|
-
|
9
|
-
def initialize(nameserver:)
|
10
|
-
@nameserver = nameserver
|
11
|
-
end
|
12
|
-
|
13
|
-
def get_resource(domain, type)
|
14
|
-
_resolver.getresource(domain, resource_by_type(type)).address.to_s
|
15
|
-
rescue Resolv::ResolvError => _e
|
16
|
-
nil
|
17
|
-
end
|
18
|
-
|
19
|
-
def get_resources(domain, type)
|
20
|
-
_resolver.getresources(domain, resource_by_type(type)).map { |r| r.address.to_s }
|
21
|
-
rescue Resolv::ResolvError => _e
|
22
|
-
nil
|
23
|
-
end
|
24
|
-
|
25
|
-
private
|
26
|
-
|
27
|
-
def _resolver
|
28
|
-
@_resolver ||= Resolv::DNS.new(nameserver: [nameserver])
|
29
|
-
@_resolver.timeouts = 5
|
30
|
-
@_resolver
|
31
|
-
end
|
32
|
-
|
33
|
-
def resource_by_type(type)
|
34
|
-
resources.dig(type.upcase.to_sym)
|
35
|
-
end
|
36
|
-
|
37
|
-
def resources
|
38
|
-
{
|
39
|
-
ANY: Resolv::DNS::Resource::IN::ANY,
|
40
|
-
NS: Resolv::DNS::Resource::IN::NS,
|
41
|
-
CNAME: Resolv::DNS::Resource::IN::CNAME,
|
42
|
-
SOA: Resolv::DNS::Resource::IN::SOA,
|
43
|
-
HINFO: Resolv::DNS::Resource::IN::HINFO,
|
44
|
-
MINFO: Resolv::DNS::Resource::IN::MINFO,
|
45
|
-
MX: Resolv::DNS::Resource::IN::MX,
|
46
|
-
TXT: Resolv::DNS::Resource::IN::TXT,
|
47
|
-
A: Resolv::DNS::Resource::IN::A,
|
48
|
-
WKS: Resolv::DNS::Resource::IN::WKS,
|
49
|
-
PTR: Resolv::DNS::Resource::IN::PTR,
|
50
|
-
AAAA: Resolv::DNS::Resource::IN::AAAA,
|
51
|
-
SRV: Resolv::DNS::Resource::IN::SRV,
|
52
|
-
}
|
53
|
-
end
|
54
|
-
end
|
55
|
-
end
|