dns-security-mcp 0.1.0

package/dist/dns/index.js

@@ -0,0 +1,1211 @@
+import { z } from "zod";
+import { text, json } from "../types/index.js";
+import { resolveAll, queryRaw, queryTcp, createResolver, isValidDomain, PUBLIC_RESOLVERS, SUBDOMAIN_WORDLIST, } from "../utils/dns-client.js";
+import { TTLCache } from "../utils/cache.js";
+import * as dns from "node:dns/promises";
+import * as dgram from "node:dgram";
+import * as dnsPacket from "dns-packet";
+// ─── Caches ───
+const lookupCache = new TTLCache(5 * 60 * 1000);
+const subdomainCache = new TTLCache(10 * 60 * 1000);
+// ─── Tool 1: dns_lookup ───
+const dnsLookup = {
+    name: "dns_lookup",
+    description: "Resolve all DNS record types for a domain in parallel. Returns A, AAAA, MX, TXT, NS, SOA, CNAME, SRV, and CAA records. " +
+        "Optionally specify record types or a custom resolver.",
+    schema: {
+        domain: z.string().describe("The domain name to resolve (e.g. 'example.com')"),
+        types: z
+            .array(z.string())
+            .optional()
+            .describe("Record types to query (e.g. ['A', 'MX', 'TXT']). Defaults to all common types."),
+        resolver: z
+            .string()
+            .optional()
+            .describe("Custom DNS resolver IP to use (e.g. '8.8.8.8'). Uses system default if omitted."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const types = args.types;
+        const resolver = args.resolver;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        const cacheKey = `lookup:${domain}:${(types ?? []).join(",")}:${resolver ?? "default"}`;
+        const cached = lookupCache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        try {
+            const records = await resolveAll(domain, types, resolver);
+            if (records.length === 0) {
+                return json({ domain, records: [], message: "No DNS records found." });
+            }
+            // Group by type for readability
+            const grouped = {};
+            for (const r of records) {
+                if (!grouped[r.type])
+                    grouped[r.type] = [];
+                grouped[r.type].push({ data: r.data, ttl: r.ttl });
+            }
+            const result = {
+                domain,
+                resolver: resolver ?? "system default",
+                total_records: records.length,
+                records: grouped,
+                raw: records,
+            };
+            lookupCache.set(cacheKey, result);
+            return json(result);
+        }
+        catch (err) {
+            return text(`DNS lookup failed for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 2: dns_reverse ───
+const dnsReverse = {
+    name: "dns_reverse",
+    description: "Perform PTR (reverse DNS) lookup on an IP address with Forward Confirmed rDNS (FCrDNS) validation. " +
+        "Resolves the PTR record, then forward-resolves the resulting hostname to confirm it maps back to the original IP.",
+    schema: {
+        ip: z.string().describe("The IP address to perform reverse DNS on (e.g. '8.8.8.8')"),
+    },
+    async execute(args) {
+        const ip = args.ip;
+        try {
+            // Step 1: PTR lookup
+            let hostnames;
+            try {
+                hostnames = await dns.reverse(ip);
+            }
+            catch {
+                return json({
+                    ip,
+                    ptr_records: [],
+                    fcrdns_validated: false,
+                    message: "No PTR record found for this IP address.",
+                });
+            }
+            if (hostnames.length === 0) {
+                return json({
+                    ip,
+                    ptr_records: [],
+                    fcrdns_validated: false,
+                    message: "No PTR record found for this IP address.",
+                });
+            }
+            // Step 2: FCrDNS — forward-resolve each hostname, check if it maps back
+            const results = await Promise.all(hostnames.map(async (hostname) => {
+                try {
+                    const resolver = createResolver();
+                    const aRecords = await resolver.resolve4(hostname).catch(() => []);
+                    const aaaaRecords = await resolver.resolve6(hostname).catch(() => []);
+                    const allIps = [...aRecords, ...aaaaRecords];
+                    const confirmed = allIps.includes(ip);
+                    return {
+                        hostname,
+                        forward_ips: allIps,
+                        fcrdns_match: confirmed,
+                    };
+                }
+                catch {
+                    return {
+                        hostname,
+                        forward_ips: [],
+                        fcrdns_match: false,
+                        error: "Forward resolution failed",
+                    };
+                }
+            }));
+            const anyConfirmed = results.some((r) => r.fcrdns_match);
+            return json({
+                ip,
+                ptr_records: hostnames,
+                fcrdns_results: results,
+                fcrdns_validated: anyConfirmed,
+                security_note: anyConfirmed
+                    ? "FCrDNS validated — the PTR record is confirmed by forward DNS."
+                    : "FCrDNS FAILED — the hostname does not resolve back to this IP. This may indicate a misconfiguration or spoofed PTR record.",
+            });
+        }
+        catch (err) {
+            return text(`Reverse DNS failed for ${ip}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 3: dns_zone_transfer ───
+const dnsZoneTransfer = {
+    name: "dns_zone_transfer",
+    description: "Attempt an AXFR (full zone transfer) against a domain's nameserver via TCP. " +
+        "If the nameserver allows zone transfers, all DNS records in the zone are returned. " +
+        "An open zone transfer is a critical security misconfiguration.",
+    schema: {
+        domain: z.string().describe("The domain to attempt zone transfer on (e.g. 'example.com')"),
+        nameserver: z
+            .string()
+            .optional()
+            .describe("Specific nameserver to target. If omitted, the domain's authoritative NS is used."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        let nameserver = args.nameserver;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        try {
+            // Resolve nameserver if not provided
+            if (!nameserver) {
+                const resolver = createResolver();
+                const nsRecords = await resolver.resolveNs(domain);
+                if (nsRecords.length === 0) {
+                    return text(`No NS records found for ${domain}. Cannot attempt zone transfer.`);
+                }
+                nameserver = nsRecords[0];
+            }
+            // Resolve nameserver hostname to IP if needed
+            let nsIp = nameserver;
+            if (!nsIp.match(/^\d+\.\d+\.\d+\.\d+$/)) {
+                const resolver = createResolver();
+                const ips = await resolver.resolve4(nameserver);
+                if (ips.length === 0) {
+                    return text(`Cannot resolve nameserver ${nameserver} to an IP address.`);
+                }
+                nsIp = ips[0];
+            }
+            // Attempt AXFR
+            const answers = await queryTcp(domain, "AXFR", nsIp, 53);
+            if (answers.length === 0) {
+                return json({
+                    domain,
+                    nameserver,
+                    nameserver_ip: nsIp,
+                    transfer_allowed: false,
+                    records: [],
+                    security_assessment: {
+                        status: "SECURE",
+                        message: "Zone transfer was denied (AXFR refused or returned no records). This is the expected secure configuration.",
+                    },
+                });
+            }
+            // Format records
+            const records = answers.map((a) => ({
+                name: a.name,
+                type: a.type,
+                ttl: a.ttl ?? 0,
+                data: a.data?.toString?.() ?? JSON.stringify(a.data),
+            }));
+            return json({
+                domain,
+                nameserver,
+                nameserver_ip: nsIp,
+                transfer_allowed: true,
+                record_count: records.length,
+                records,
+                security_assessment: {
+                    status: "CRITICAL",
+                    severity: "critical",
+                    message: "Zone transfer ALLOWED! This exposes the entire DNS zone, revealing all subdomains, IPs, and mail servers. " +
+                        "An attacker can map the entire infrastructure.",
+                    remediation: "Restrict AXFR to authorized secondary nameservers only. " +
+                        "In BIND: use 'allow-transfer' directive. " +
+                        "In Windows DNS: configure zone transfer restrictions in DNS Manager.",
+                },
+            });
+        }
+        catch (err) {
+            const errMsg = err.message;
+            // Connection refused / timeout generally means AXFR is denied
+            if (errMsg.includes("timeout") || errMsg.includes("ECONNREFUSED") || errMsg.includes("ECONNRESET")) {
+                return json({
+                    domain,
+                    nameserver,
+                    transfer_allowed: false,
+                    security_assessment: {
+                        status: "SECURE",
+                        message: `Zone transfer denied or connection failed: ${errMsg}`,
+                    },
+                });
+            }
+            return text(`Zone transfer failed: ${errMsg}`);
+        }
+    },
+};
+// ─── Tool 4: dns_subdomain_enum ───
+const dnsSubdomainEnum = {
+    name: "dns_subdomain_enum",
+    description: "Enumerate subdomains using passive CT (Certificate Transparency) log lookups via crt.sh and active DNS brute-force. " +
+        "Deduplicates results and resolves each discovered subdomain to get its IP addresses.",
+    schema: {
+        domain: z.string().describe("The target domain to enumerate subdomains for (e.g. 'example.com')"),
+        wordlist: z
+            .array(z.string())
+            .optional()
+            .describe("Custom subdomain wordlist for brute-force. Uses built-in top-200 wordlist if omitted."),
+        use_ct: z
+            .boolean()
+            .optional()
+            .describe("Whether to query Certificate Transparency logs via crt.sh (default: true)"),
+        limit: z
+            .number()
+            .optional()
+            .describe("Maximum number of subdomains to return (default: 500)"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const wordlist = args.wordlist ?? SUBDOMAIN_WORDLIST;
+        const useCt = args.use_ct ?? true;
+        const limit = args.limit ?? 500;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        const cacheKey = `subenum:${domain}:${useCt}:${limit}`;
+        const cached = subdomainCache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        const found = new Set();
+        const errors = [];
+        // Passive: crt.sh CT log lookup
+        if (useCt) {
+            try {
+                const url = `https://crt.sh/?q=%25.${encodeURIComponent(domain)}&output=json`;
+                const res = await fetch(url, { signal: AbortSignal.timeout(10000) });
+                if (res.ok) {
+                    const data = (await res.json());
+                    for (const entry of data) {
+                        const names = entry.name_value.split("\n");
+                        for (const name of names) {
+                            const clean = name.trim().toLowerCase().replace(/^\*\./, "");
+                            if (clean.endsWith(`.${domain}`) || clean === domain) {
+                                found.add(clean);
+                            }
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                errors.push(`crt.sh lookup failed: ${err.message}`);
+            }
+        }
+        // Active: DNS brute-force
+        const resolver = createResolver();
+        const BATCH_SIZE = 50;
+        for (let i = 0; i < wordlist.length; i += BATCH_SIZE) {
+            const batch = wordlist.slice(i, i + BATCH_SIZE);
+            const tasks = batch.map(async (sub) => {
+                const fqdn = `${sub}.${domain}`;
+                try {
+                    const addrs = await resolver.resolve4(fqdn);
+                    if (addrs.length > 0)
+                        found.add(fqdn);
+                }
+                catch {
+                    // NXDOMAIN or timeout — not a valid subdomain
+                }
+            });
+            await Promise.allSettled(tasks);
+            // Check limit
+            if (found.size >= limit)
+                break;
+        }
+        // Resolve IPs for all found subdomains
+        const subdomains = Array.from(found).slice(0, limit);
+        const resolvedResults = await Promise.allSettled(subdomains.map(async (sub) => {
+            try {
+                const ips = await resolver.resolve4(sub);
+                return { subdomain: sub, ips };
+            }
+            catch {
+                return { subdomain: sub, ips: [] };
+            }
+        }));
+        const resolved = resolvedResults
+            .filter((r) => r.status === "fulfilled")
+            .map((r) => r.value);
+        // Unique IPs summary
+        const allIps = new Set();
+        for (const r of resolved) {
+            for (const ip of r.ips)
+                allIps.add(ip);
+        }
+        const result = {
+            domain,
+            total_subdomains: resolved.length,
+            unique_ips: allIps.size,
+            sources: {
+                ct_logs: useCt,
+                brute_force: true,
+                wordlist_size: wordlist.length,
+            },
+            subdomains: resolved,
+            errors: errors.length > 0 ? errors : undefined,
+        };
+        subdomainCache.set(cacheKey, result);
+        return json(result);
+    },
+};
+// ─── Tool 5: dns_cache_snoop ───
+const dnsCacheSnoop = {
+    name: "dns_cache_snoop",
+    description: "Perform DNS cache snooping by sending a non-recursive query (RD=0) to a nameserver. " +
+        "If the server returns an answer without performing recursion, the domain was previously cached, " +
+        "revealing that someone behind that resolver recently visited the domain.",
+    schema: {
+        domain: z.string().describe("The domain to check in the nameserver's cache (e.g. 'google.com')"),
+        nameserver: z.string().describe("The DNS nameserver IP to snoop on (e.g. '8.8.8.8')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const nameserver = args.nameserver;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        try {
+            // Send non-recursive query (RD=0)
+            const result = await queryRaw(domain, "A", nameserver, 53, { rd: false });
+            const isCached = result.answers.length > 0;
+            const records = result.answers.map((a) => ({
+                name: a.name,
+                type: a.type,
+                ttl: a.ttl ?? 0,
+                data: a.data?.toString?.() ?? JSON.stringify(a.data),
+            }));
+            return json({
+                domain,
+                nameserver,
+                cached: isCached,
+                rcode: result.rcode,
+                flags: result.flags,
+                cached_records: records,
+                analysis: isCached
+                    ? `Domain '${domain}' IS cached on ${nameserver}. TTL remaining: ${records[0]?.ttl ?? "unknown"}s. ` +
+                        "This indicates recent DNS queries for this domain from clients using this resolver."
+                    : `Domain '${domain}' is NOT cached on ${nameserver}. No recent lookups detected.`,
+                security_note: "Cache snooping can reveal which websites users behind a resolver are visiting. " +
+                    "Recursive resolvers should disable non-recursive queries from external sources.",
+            });
+        }
+        catch (err) {
+            return text(`Cache snooping failed: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 6: dns_nsec_walk ───
+const dnsNsecWalk = {
+    name: "dns_nsec_walk",
+    description: "Attempt DNSSEC NSEC zone walking to enumerate domain names in a signed zone. " +
+        "NSEC records contain the 'next' domain name in the zone, allowing complete enumeration. " +
+        "NSEC3 uses hashed names to mitigate this, which is detected and reported.",
+    schema: {
+        domain: z.string().describe("The DNSSEC-signed domain to walk (e.g. 'example.com')"),
+        limit: z
+            .number()
+            .optional()
+            .describe("Maximum number of names to enumerate (default: 100)"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const limit = args.limit ?? 100;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        try {
+            // First, determine which NSEC variant is in use
+            // Query for a name that likely doesn't exist to trigger NSEC/NSEC3 in authority
+            const probeResult = await queryRaw(`_nsec_walk_probe_${Date.now()}.${domain}`, "A", "8.8.8.8", 53, {
+                rd: true,
+                dnssec: true,
+            });
+            // Check authority section for NSEC3 vs NSEC
+            const nsec3Records = probeResult.authorities.filter((a) => a.type === "NSEC3" || a.type === "NSEC3PARAM");
+            const nsecRecords = probeResult.authorities.filter((a) => a.type === "NSEC");
+            if (nsec3Records.length > 0) {
+                return json({
+                    domain,
+                    nsec_type: "NSEC3",
+                    zone_walkable: false,
+                    nsec3_records: nsec3Records.map((r) => ({
+                        name: r.name,
+                        type: r.type,
+                        data: r.data,
+                    })),
+                    message: "NSEC3 is in use — zone walking is mitigated. NSEC3 hashes domain names, preventing direct enumeration. " +
+                        "However, offline dictionary attacks against NSEC3 hashes may still be possible depending on the hash iterations and salt.",
+                    security_assessment: {
+                        status: "PROTECTED",
+                        detail: "Zone uses NSEC3, which prevents trivial zone enumeration via NSEC walking.",
+                    },
+                });
+            }
+            if (nsecRecords.length === 0) {
+                return json({
+                    domain,
+                    nsec_type: "NONE",
+                    zone_walkable: false,
+                    message: "No NSEC or NSEC3 records found. The zone may not be DNSSEC-signed, " +
+                        "or the resolver is stripping DNSSEC records.",
+                });
+            }
+            // NSEC zone walking
+            const enumerated = [];
+            let currentName = domain;
+            const visited = new Set();
+            for (let i = 0; i < limit; i++) {
+                if (visited.has(currentName))
+                    break;
+                visited.add(currentName);
+                try {
+                    const nsecResult = await queryRaw(currentName, "NSEC", "8.8.8.8", 53, {
+                        rd: true,
+                        dnssec: true,
+                    });
+                    // Look for NSEC in answers and authorities
+                    const allNsec = [...nsecResult.answers, ...nsecResult.authorities].filter((a) => a.type === "NSEC");
+                    if (allNsec.length === 0)
+                        break;
+                    for (const nsec of allNsec) {
+                        const nsecData = nsec;
+                        const nextDomain = nsecData.data?.nextDomain ?? nsecData.data;
+                        if (typeof nextDomain === "string" && nextDomain.endsWith(`.${domain}`) || nextDomain === domain) {
+                            if (!visited.has(nextDomain)) {
+                                enumerated.push(nextDomain);
+                                currentName = nextDomain;
+                            }
+                        }
+                    }
+                    // If we didn't advance, try the first NSEC's next domain
+                    const firstNsec = allNsec[0];
+                    const next = firstNsec.data?.nextDomain ?? firstNsec.data;
+                    if (typeof next === "string" && next !== currentName) {
+                        if (!visited.has(next)) {
+                            enumerated.push(next);
+                        }
+                        // If next domain wraps back to zone apex, we've completed the walk
+                        if (next === domain || !next.endsWith(`.${domain}`))
+                            break;
+                        currentName = next;
+                    }
+                    else {
+                        break;
+                    }
+                }
+                catch {
+                    break;
+                }
+            }
+            return json({
+                domain,
+                nsec_type: "NSEC",
+                zone_walkable: true,
+                names_found: enumerated.length,
+                enumerated_names: enumerated,
+                security_assessment: {
+                    status: "VULNERABLE",
+                    severity: "medium",
+                    message: "Zone uses NSEC records, allowing complete zone enumeration via NSEC walking. " +
+                        "An attacker can discover all domain names in the zone.",
+                    remediation: "Migrate from NSEC to NSEC3 to prevent zone walking. " +
+                        "Use 'nsec3param 1 0 10 <salt>' in your DNSSEC configuration.",
+                },
+            });
+        }
+        catch (err) {
+            return text(`NSEC walk failed: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 7: dns_wildcard_detect ───
+const dnsWildcardDetect = {
+    name: "dns_wildcard_detect",
+    description: "Detect wildcard DNS configurations by resolving multiple random non-existent subdomains. " +
+        "If all random names resolve to the same IP, a wildcard record (*.domain) is in place. " +
+        "Wildcard DNS can affect subdomain enumeration accuracy and security assessments.",
+    schema: {
+        domain: z.string().describe("The domain to test for wildcard DNS (e.g. 'example.com')"),
+        samples: z
+            .number()
+            .optional()
+            .describe("Number of random subdomains to test (default: 10)"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const samples = args.samples ?? 10;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        try {
+            const resolver = createResolver();
+            const randomNames = [];
+            const resolvedIps = new Map();
+            let resolveCount = 0;
+            let nxdomainCount = 0;
+            // Generate random subdomain labels
+            for (let i = 0; i < samples; i++) {
+                const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
+                let label = "";
+                for (let j = 0; j < 12; j++) {
+                    label += chars[Math.floor(Math.random() * chars.length)];
+                }
+                randomNames.push(`${label}.${domain}`);
+            }
+            // Resolve all random names
+            const results = await Promise.allSettled(randomNames.map(async (name) => {
+                try {
+                    const ips = await resolver.resolve4(name);
+                    return { name, ips, resolved: true };
+                }
+                catch {
+                    return { name, ips: [], resolved: false };
+                }
+            }));
+            const ipCounts = new Map();
+            for (const r of results) {
+                if (r.status === "fulfilled") {
+                    if (r.value.resolved && r.value.ips.length > 0) {
+                        resolveCount++;
+                        resolvedIps.set(r.value.name, r.value.ips);
+                        for (const ip of r.value.ips) {
+                            ipCounts.set(ip, (ipCounts.get(ip) ?? 0) + 1);
+                        }
+                    }
+                    else {
+                        nxdomainCount++;
+                    }
+                }
+            }
+            const wildcardDetected = resolveCount >= Math.floor(samples * 0.8);
+            // Find the most common IP
+            let wildcardIp = null;
+            let maxCount = 0;
+            ipCounts.forEach((count, ip) => {
+                if (count > maxCount) {
+                    maxCount = count;
+                    wildcardIp = ip;
+                }
+            });
+            return json({
+                domain,
+                samples_tested: samples,
+                resolved_count: resolveCount,
+                nxdomain_count: nxdomainCount,
+                wildcard_detected: wildcardDetected,
+                wildcard_ip: wildcardDetected ? wildcardIp : null,
+                ip_distribution: Object.fromEntries(ipCounts),
+                analysis: wildcardDetected
+                    ? `Wildcard DNS detected for *.${domain} — random subdomains resolve to ${wildcardIp}. ` +
+                        "This means ANY subdomain will resolve, which can mask subdomain enumeration results."
+                    : `No wildcard DNS detected for ${domain}. Random subdomains returned NXDOMAIN as expected.`,
+                impact: wildcardDetected
+                    ? [
+                        "Subdomain brute-force results will contain false positives",
+                        "Content-based verification needed to distinguish real subdomains",
+                        "May be used for catch-all web hosting or email",
+                    ]
+                    : [],
+            });
+        }
+        catch (err) {
+            return text(`Wildcard detection failed: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 8: dns_server_fingerprint ───
+const dnsServerFingerprint = {
+    name: "dns_server_fingerprint",
+    description: "Fingerprint a DNS server by querying CHAOS class TXT records (version.bind, version.server, hostname.bind, id.server). " +
+        "These records can reveal the DNS software type and version (BIND, PowerDNS, Unbound, Knot, dnsmasq, Windows DNS).",
+    schema: {
+        nameserver: z.string().describe("The DNS server IP or hostname to fingerprint (e.g. '8.8.8.8')"),
+    },
+    async execute(args) {
+        let nameserver = args.nameserver;
+        // Resolve hostname to IP if needed
+        if (!nameserver.match(/^\d+\.\d+\.\d+\.\d+$/)) {
+            try {
+                const resolver = createResolver();
+                const ips = await resolver.resolve4(nameserver);
+                nameserver = ips[0];
+            }
+            catch {
+                return text(`Cannot resolve nameserver hostname: ${nameserver}`);
+            }
+        }
+        const chaosQueries = [
+            { name: "version.bind", label: "version_bind" },
+            { name: "version.server", label: "version_server" },
+            { name: "hostname.bind", label: "hostname_bind" },
+            { name: "id.server", label: "id_server" },
+        ];
+        const results = {};
+        // Send CHAOS class TXT queries using dgram + dns-packet
+        for (const query of chaosQueries) {
+            try {
+                const answer = await sendChaosQuery(query.name, nameserver);
+                results[query.label] = answer;
+            }
+            catch {
+                results[query.label] = null;
+            }
+        }
+        // Identify DNS software from responses
+        const versionStr = results.version_bind ?? results.version_server ?? "";
+        const softwareGuess = identifyDnsSoftware(versionStr);
+        // Also do behavioral fingerprinting: check for recursion support
+        let recursionAvailable = false;
+        try {
+            const probeResult = await queryRaw("example.com", "A", nameserver, 53, { rd: true });
+            recursionAvailable = probeResult.flags.recursionAvailable;
+        }
+        catch {
+            // Ignore
+        }
+        return json({
+            nameserver,
+            chaos_records: results,
+            identified_software: softwareGuess,
+            recursion_available: recursionAvailable,
+            analysis: versionStr
+                ? `DNS server at ${nameserver} identified as: ${softwareGuess.software ?? "Unknown"} (version: ${versionStr})`
+                : `DNS server at ${nameserver} did not respond to CHAOS queries. Version information is hidden.`,
+            security_note: "Exposing DNS version information helps attackers identify known vulnerabilities. " +
+                "Best practice: disable version.bind/version.server responses or set them to a generic value.",
+        });
+    },
+};
+/** Send a CHAOS class TXT query using raw UDP socket + dns-packet */
+async function sendChaosQuery(name, server, port = 53) {
+    // dns-packet doesn't directly support CHAOS class in the high-level API,
+    // so we build the packet manually
+    const id = Math.floor(Math.random() * 65535);
+    // Build a DNS query packet manually with CHAOS class (class=3)
+    const questionBuf = encodeChaosQuestion(id, name);
+    return new Promise((resolve, reject) => {
+        const socket = dgram.createSocket("udp4");
+        const timer = setTimeout(() => {
+            socket.close();
+            resolve(null);
+        }, 5000);
+        socket.on("message", (msg) => {
+            clearTimeout(timer);
+            socket.close();
+            try {
+                // Parse the response — dns-packet can decode it even with CHAOS class
+                const res = dnsPacket.decode(msg);
+                const txtAnswers = (res.answers ?? []).filter((a) => a.type === "TXT");
+                if (txtAnswers.length > 0) {
+                    const data = txtAnswers[0].data;
+                    if (Buffer.isBuffer(data)) {
+                        resolve(data.toString("utf-8"));
+                    }
+                    else if (Array.isArray(data)) {
+                        resolve(data.map((d) => (Buffer.isBuffer(d) ? d.toString("utf-8") : String(d))).join(""));
+                    }
+                    else if (typeof data === "string") {
+                        resolve(data);
+                    }
+                    else {
+                        resolve(JSON.stringify(data));
+                    }
+                }
+                else {
+                    resolve(null);
+                }
+            }
+            catch {
+                resolve(null);
+            }
+        });
+        socket.on("error", () => {
+            clearTimeout(timer);
+            socket.close();
+            resolve(null);
+        });
+        socket.send(questionBuf, 0, questionBuf.length, port, server);
+    });
+}
+/** Manually encode a DNS query with CHAOS class (CH=3) since dns-packet defaults to IN */
+function encodeChaosQuestion(id, name) {
+    // Encode the domain name in DNS wire format
+    const labels = name.split(".");
+    const nameParts = [];
+    for (const label of labels) {
+        nameParts.push(label.length);
+        for (let i = 0; i < label.length; i++) {
+            nameParts.push(label.charCodeAt(i));
+        }
+    }
+    nameParts.push(0); // Root label
+    // DNS header: 12 bytes
+    const header = Buffer.alloc(12);
+    header.writeUInt16BE(id, 0); // ID
+    header.writeUInt16BE(0x0100, 2); // Flags: RD=1 (standard recursive query)
+    header.writeUInt16BE(1, 4); // QDCOUNT = 1
+    header.writeUInt16BE(0, 6); // ANCOUNT = 0
+    header.writeUInt16BE(0, 8); // NSCOUNT = 0
+    header.writeUInt16BE(0, 10); // ARCOUNT = 0
+    // Question section: name + QTYPE(TXT=16) + QCLASS(CH=3)
+    const questionSuffix = Buffer.alloc(4);
+    questionSuffix.writeUInt16BE(16, 0); // QTYPE = TXT
+    questionSuffix.writeUInt16BE(3, 2); // QCLASS = CH (CHAOS)
+    return Buffer.concat([header, Buffer.from(nameParts), questionSuffix]);
+}
+/** Identify DNS software from version string */
+function identifyDnsSoftware(version) {
+    if (!version)
+        return { software: null, confidence: "none" };
+    const v = version.toLowerCase();
+    if (v.includes("bind") || v.includes("isc")) {
+        return { software: `ISC BIND (${version})`, confidence: "high" };
+    }
+    if (v.includes("powerdns") || v.includes("pdns")) {
+        return { software: `PowerDNS (${version})`, confidence: "high" };
+    }
+    if (v.includes("unbound")) {
+        return { software: `Unbound (${version})`, confidence: "high" };
+    }
+    if (v.includes("knot")) {
+        return { software: `Knot DNS (${version})`, confidence: "high" };
+    }
+    if (v.includes("dnsmasq")) {
+        return { software: `dnsmasq (${version})`, confidence: "high" };
+    }
+    if (v.includes("microsoft") || v.includes("windows")) {
+        return { software: `Microsoft DNS (${version})`, confidence: "high" };
+    }
+    if (v.includes("nsd")) {
+        return { software: `NSD (${version})`, confidence: "high" };
+    }
+    if (v.includes("maradns")) {
+        return { software: `MaraDNS (${version})`, confidence: "high" };
+    }
+    if (v.includes("coredns")) {
+        return { software: `CoreDNS (${version})`, confidence: "high" };
+    }
+    return { software: `Unknown (${version})`, confidence: "low" };
+}
+// ─── Tool 9: dns_recursive_check ───
+const dnsRecursiveCheck = {
+    name: "dns_recursive_check",
+    description: "Test whether a DNS nameserver is an open recursive resolver by sending a recursive query (RD=1) for an external domain. " +
+        "Open recursive resolvers are a security risk — they can be abused for DNS amplification DDoS attacks " +
+        "and cache poisoning.",
+    schema: {
+        nameserver: z.string().describe("The DNS nameserver IP to test for open recursion (e.g. '192.168.1.1')"),
+    },
+    async execute(args) {
+        const nameserver = args.nameserver;
+        // Use a well-known external domain to test recursion
+        const testDomains = ["www.google.com", "www.cloudflare.com", "www.example.org"];
+        const results = [];
+        for (const testDomain of testDomains) {
+            try {
+                const result = await queryRaw(testDomain, "A", nameserver, 53, { rd: true });
+                results.push({
+                    domain: testDomain,
+                    resolved: result.answers.length > 0,
+                    answers: result.answers.length,
+                    recursion_available: result.flags.recursionAvailable,
+                });
+            }
+            catch {
+                results.push({
+                    domain: testDomain,
+                    resolved: false,
+                    answers: 0,
+                    recursion_available: false,
+                });
+            }
+        }
+        const isOpenRecursive = results.some((r) => r.resolved && r.recursion_available);
+        const allRecursive = results.every((r) => r.resolved && r.recursion_available);
+        return json({
+            nameserver,
+            is_open_recursive: isOpenRecursive,
+            test_results: results,
+            security_assessment: isOpenRecursive
+                ? {
+                    status: "HIGH_RISK",
+                    severity: "high",
+                    message: allRecursive
+                        ? `Nameserver ${nameserver} is an OPEN RECURSIVE RESOLVER. It resolved all test domains with recursion. ` +
+                            "This server can be abused for DNS amplification attacks and may be susceptible to cache poisoning."
+                        : `Nameserver ${nameserver} appears to allow recursion for some domains. Partial open recursion detected.`,
+                    risks: [
+                        "DNS amplification DDoS attacks (response is 28-54x larger than query)",
+                        "DNS cache poisoning",
+                        "Information leakage via cache snooping",
+                        "Resource consumption from external queries",
+                    ],
+                    remediation: [
+                        "Restrict recursion to trusted client IP ranges only",
+                        "Use 'allow-recursion' ACLs in BIND",
+                        "Enable Response Rate Limiting (RRL)",
+                        "Consider deploying a dedicated recursive resolver for internal use only",
+                    ],
+                }
+                : {
+                    status: "SECURE",
+                    message: `Nameserver ${nameserver} does not appear to be an open recursive resolver. Recursion is properly restricted.`,
+                },
+        });
+    },
+};
+// ─── Tool 10: dns_propagation ───
+const dnsPropagation = {
+    name: "dns_propagation",
+    description: "Check DNS propagation by querying 20+ globally distributed public resolvers. " +
+        "Reports per-resolver results and a consistency check to detect incomplete propagation " +
+        "or geo-based DNS differences.",
+    schema: {
+        domain: z.string().describe("The domain name to check propagation for (e.g. 'example.com')"),
+        type: z
+            .string()
+            .optional()
+            .describe("DNS record type to query (default: 'A'). Supports A, AAAA, MX, TXT, NS, CNAME."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const type = args.type ?? "A";
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        const resolverResults = await Promise.allSettled(PUBLIC_RESOLVERS.map(async (r) => {
+            try {
+                const resolver = createResolver(r.ip);
+                let data = [];
+                switch (type.toUpperCase()) {
+                    case "A": {
+                        data = await resolver.resolve4(domain);
+                        break;
+                    }
+                    case "AAAA": {
+                        data = await resolver.resolve6(domain);
+                        break;
+                    }
+                    case "MX": {
+                        const mx = await resolver.resolveMx(domain);
+                        data = mx.map((m) => `${m.priority} ${m.exchange}`);
+                        break;
+                    }
+                    case "TXT": {
+                        const txt = await resolver.resolveTxt(domain);
+                        data = txt.map((t) => t.join(""));
+                        break;
+                    }
+                    case "NS": {
+                        data = await resolver.resolveNs(domain);
+                        break;
+                    }
+                    case "CNAME": {
+                        data = await resolver.resolveCname(domain);
+                        break;
+                    }
+                    default: {
+                        data = await resolver.resolve4(domain);
+                    }
+                }
+                return {
+                    resolver: r.name,
+                    ip: r.ip,
+                    location: r.location,
+                    status: "ok",
+                    results: data.sort(),
+                };
+            }
+            catch (err) {
+                return {
+                    resolver: r.name,
+                    ip: r.ip,
+                    location: r.location,
+                    status: "error",
+                    results: [],
+                    error: err.message,
+                };
+            }
+        }));
+        const results = resolverResults
+            .filter((r) => r.status === "fulfilled")
+            .map((r) => r.value);
+        // Consistency analysis
+        const successResults = results.filter((r) => r.status === "ok" && r.results.length > 0);
+        const failedResults = results.filter((r) => r.status === "error" || r.results.length === 0);
+        // Group by unique response
+        const responseGroups = new Map();
+        for (const r of successResults) {
+            const key = JSON.stringify(r.results);
+            if (!responseGroups.has(key))
+                responseGroups.set(key, []);
+            responseGroups.get(key).push(r.resolver);
+        }
+        const isConsistent = responseGroups.size <= 1;
+        const propagationPercent = successResults.length > 0
+            ? Math.round((successResults.length / results.length) * 100)
+            : 0;
+        return json({
+            domain,
+            record_type: type.toUpperCase(),
+            resolvers_queried: results.length,
+            successful: successResults.length,
+            failed: failedResults.length,
+            propagation_percent: propagationPercent,
+            consistent: isConsistent,
+            unique_responses: responseGroups.size,
+            response_groups: Array.from(responseGroups.entries()).map(([response, resolvers]) => ({
+                values: JSON.parse(response),
+                resolvers,
+                count: resolvers.length,
+            })),
+            per_resolver: results,
+            analysis: isConsistent
+                ? `DNS propagation is complete and consistent. All ${successResults.length} resolvers return the same result.`
+                : `DNS propagation is INCONSISTENT. ${responseGroups.size} different responses detected across resolvers. ` +
+                    "This may indicate ongoing propagation, geo-based DNS, or CDN-based responses.",
+        });
+    },
+};
+// ─── Tool 11: dns_split_horizon ───
+const dnsSplitHorizon = {
+    name: "dns_split_horizon",
+    description: "Detect split-horizon (split-brain) DNS configurations by comparing responses from multiple external resolvers " +
+        "and an optional internal resolver. Split-horizon DNS returns different answers based on the source of the query, " +
+        "commonly used to serve internal IPs to corporate networks and external IPs to the internet.",
+    schema: {
+        domain: z.string().describe("The domain to test for split-horizon DNS (e.g. 'internal.company.com')"),
+        internal_resolver: z
+            .string()
+            .optional()
+            .describe("Internal/corporate DNS resolver IP to compare against external resolvers (e.g. '10.0.0.1')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const internalResolver = args.internal_resolver;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        // Select a subset of external resolvers for comparison
+        const externalResolvers = PUBLIC_RESOLVERS.slice(0, 6);
+        const allResolvers = [
+            ...externalResolvers.map((r) => ({ name: r.name, ip: r.ip, type: "external" })),
+        ];
+        if (internalResolver) {
+            allResolvers.push({ name: "Internal", ip: internalResolver, type: "internal" });
+        }
+        // Query all resolvers for A and AAAA records
+        const queryResults = await Promise.allSettled(allResolvers.map(async (r) => {
+            const resolver = createResolver(r.ip);
+            const aRecords = await resolver.resolve4(domain).catch(() => []);
+            const aaaaRecords = await resolver.resolve6(domain).catch(() => []);
+            return {
+                resolver_name: r.name,
+                resolver_ip: r.ip,
+                resolver_type: r.type,
+                a_records: aRecords.sort(),
+                aaaa_records: aaaaRecords.sort(),
+            };
+        }));
+        const results = queryResults
+            .filter((r) => r.status === "fulfilled")
+            .map((r) => r.value);
+        // Analyze for split-horizon
+        const externalResults = results.filter((r) => r.resolver_type === "external");
+        const internalResults = results.filter((r) => r.resolver_type === "internal");
+        // Check consistency among external resolvers
+        const externalAResponses = new Set(externalResults.map((r) => JSON.stringify(r.a_records)));
+        const externalConsistent = externalAResponses.size <= 1;
+        // Check for split-horizon between internal and external
+        let splitHorizonDetected = false;
+        let splitDetails = null;
+        if (internalResults.length > 0 && externalResults.length > 0) {
+            const internalA = JSON.stringify(internalResults[0].a_records);
+            const externalA = JSON.stringify(externalResults[0].a_records);
+            if (internalA !== externalA && internalResults[0].a_records.length > 0) {
+                splitHorizonDetected = true;
+                splitDetails = {
+                    internal_ips: internalResults[0].a_records,
+                    external_ips: externalResults[0].a_records,
+                    private_ips_internal: internalResults[0].a_records.filter((ip) => ip.startsWith("10.") || ip.startsWith("172.") || ip.startsWith("192.168.")),
+                };
+            }
+        }
+        // Even without internal resolver, detect CDN/geo-based differences
+        const geoDifferences = !externalConsistent;
+        return json({
+            domain,
+            internal_resolver: internalResolver ?? "not specified",
+            split_horizon_detected: splitHorizonDetected,
+            geo_differences_detected: geoDifferences,
+            split_details: splitDetails,
+            resolver_results: results,
+            analysis: splitHorizonDetected
+                ? `Split-horizon DNS DETECTED for ${domain}. Internal resolver returns different IPs than external resolvers. ` +
+                    (splitDetails?.private_ips_internal?.length > 0
+                        ? "Internal responses contain RFC1918 private IP addresses, confirming a split-DNS configuration."
+                        : "The internal and external responses differ, suggesting split-DNS or view-based DNS.")
+                : geoDifferences
+                    ? `No split-horizon detected, but external resolvers return different results. ` +
+                        "This may indicate CDN-based or GeoDNS responses."
+                    : `No split-horizon DNS detected for ${domain}. All resolvers return consistent results.` +
+                        (internalResolver ? "" : " Tip: provide an internal_resolver for a more thorough check."),
+        });
+    },
+};
+// ─── Tool 12: dns_ttl_analysis ───
+const dnsTtlAnalysis = {
+    name: "dns_ttl_analysis",
+    description: "Analyze DNS TTL (Time-To-Live) values across all record types for a domain. " +
+        "Flags potential security and operational issues: TTL < 60s (fast-flux indicator, common in malware C2), " +
+        "TTL > 86400s (stale cache risk during incident response), and inconsistent TTLs across record types.",
+    schema: {
+        domain: z.string().describe("The domain to analyze TTL values for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        if (!isValidDomain(domain)) {
+            return text(`Invalid domain: ${domain}`);
+        }
+        try {
+            const records = await resolveAll(domain);
+            if (records.length === 0) {
+                return json({ domain, error: "No DNS records found." });
+            }
+            // Analyze TTLs by type
+            const byType = {};
+            for (const r of records) {
+                if (!byType[r.type])
+                    byType[r.type] = { ttls: [], records: [] };
+                byType[r.type].ttls.push(r.ttl);
+                byType[r.type].records.push({ data: r.data, ttl: r.ttl });
+            }
+            const findings = [];
+            const allTtls = records.filter((r) => r.ttl > 0).map((r) => r.ttl);
+            const minTtl = allTtls.length > 0 ? Math.min(...allTtls) : 0;
+            const maxTtl = allTtls.length > 0 ? Math.max(...allTtls) : 0;
+            const avgTtl = allTtls.length > 0 ? Math.round(allTtls.reduce((a, b) => a + b, 0) / allTtls.length) : 0;
+            // Check for fast-flux indicators (TTL < 60)
+            const fastFluxRecords = records.filter((r) => r.ttl > 0 && r.ttl < 60);
+            if (fastFluxRecords.length > 0) {
+                findings.push({
+                    severity: "high",
+                    title: "Very low TTL detected (possible fast-flux)",
+                    description: `${fastFluxRecords.length} record(s) have TTL < 60 seconds. Very low TTLs are a common indicator of ` +
+                        "fast-flux networks used by malware, botnets, and phishing operations to rapidly rotate IP addresses.",
+                    affected_records: fastFluxRecords.map((r) => `${r.type} ${r.data} (TTL: ${r.ttl}s)`).join(", "),
+                });
+            }
+            // Check for low TTL (60-300) — may be CDN or dynamic
+            const lowTtlRecords = records.filter((r) => r.ttl >= 60 && r.ttl < 300);
+            if (lowTtlRecords.length > 0) {
+                findings.push({
+                    severity: "info",
+                    title: "Low TTL values (60-300s)",
+                    description: `${lowTtlRecords.length} record(s) have TTL between 60-300 seconds. This is common for CDN, ` +
+                        "load-balanced, or dynamically updated records. Generally benign but worth noting.",
+                    affected_records: lowTtlRecords.map((r) => `${r.type} ${r.data} (TTL: ${r.ttl}s)`).join(", "),
+                });
+            }
+            // Check for very high TTL (> 86400)
+            const highTtlRecords = records.filter((r) => r.ttl > 86400);
+            if (highTtlRecords.length > 0) {
+                findings.push({
+                    severity: "medium",
+                    title: "Very high TTL detected (stale cache risk)",
+                    description: `${highTtlRecords.length} record(s) have TTL > 86400 seconds (1 day). High TTLs mean changes ` +
+                        "take longer to propagate, which can delay incident response if IP addresses need to be changed urgently.",
+                    affected_records: highTtlRecords.map((r) => `${r.type} ${r.data} (TTL: ${r.ttl}s)`).join(", "),
+                });
+            }
+            // Check for TTL inconsistency within the same record type
+            for (const [type, info] of Object.entries(byType)) {
+                const uniqueTtls = new Set(info.ttls.filter((t) => t > 0));
+                if (uniqueTtls.size > 1) {
+                    findings.push({
+                        severity: "low",
+                        title: `Inconsistent TTLs for ${type} records`,
+                        description: `${type} records have ${uniqueTtls.size} different TTL values: ${Array.from(uniqueTtls).join(", ")}s. ` +
+                            "Inconsistent TTLs within the same record type may indicate misconfiguration.",
+                        affected_records: info.records.map((r) => `${r.data} (TTL: ${r.ttl}s)`).join(", "),
+                    });
+                }
+            }
+            // Check for wide TTL variance across record types
+            if (allTtls.length >= 2 && maxTtl > 0 && minTtl > 0) {
+                const ratio = maxTtl / minTtl;
+                if (ratio > 100) {
+                    findings.push({
+                        severity: "low",
+                        title: "Wide TTL variance across record types",
+                        description: `TTL values range from ${minTtl}s to ${maxTtl}s (ratio: ${Math.round(ratio)}x). ` +
+                            "Large variance may complicate DNS change propagation planning.",
+                    });
+                }
+            }
+            // Check for zero TTLs (may indicate records where TTL wasn't available)
+            const zeroTtlRecords = records.filter((r) => r.ttl === 0);
+            if (zeroTtlRecords.length > 0 && zeroTtlRecords.length < records.length) {
+                findings.push({
+                    severity: "info",
+                    title: "Records with zero TTL",
+                    description: `${zeroTtlRecords.length} record(s) have TTL=0. This may indicate the resolver did not return TTL ` +
+                        "information for these record types, or the records are set to never be cached.",
+                    affected_records: zeroTtlRecords.map((r) => `${r.type} ${r.data}`).join(", "),
+                });
+            }
+            return json({
+                domain,
+                summary: {
+                    total_records: records.length,
+                    min_ttl: minTtl,
+                    max_ttl: maxTtl,
+                    avg_ttl: avgTtl,
+                    ttl_range_human: `${formatTtl(minTtl)} — ${formatTtl(maxTtl)}`,
+                },
+                records_by_type: Object.fromEntries(Object.entries(byType).map(([type, info]) => [
+                    type,
+                    {
+                        count: info.records.length,
+                        ttl_values: Array.from(new Set(info.ttls)),
+                        records: info.records,
+                    },
+                ])),
+                findings,
+                findings_count: {
+                    critical: findings.filter((f) => f.severity === "critical").length,
+                    high: findings.filter((f) => f.severity === "high").length,
+                    medium: findings.filter((f) => f.severity === "medium").length,
+                    low: findings.filter((f) => f.severity === "low").length,
+                    info: findings.filter((f) => f.severity === "info").length,
+                },
+            });
+        }
+        catch (err) {
+            return text(`TTL analysis failed for ${domain}: ${err.message}`);
+        }
+    },
+};
+/** Format TTL value into human-readable string */
+function formatTtl(seconds) {
+    if (seconds === 0)
+        return "0s";
+    if (seconds < 60)
+        return `${seconds}s`;
+    if (seconds < 3600)
+        return `${Math.round(seconds / 60)}m`;
+    if (seconds < 86400)
+        return `${Math.round(seconds / 3600)}h`;
+    return `${Math.round(seconds / 86400)}d`;
+}
+// ─── Export All DNS Tools ───
+export const dnsTools = [
+    dnsLookup,
+    dnsReverse,
+    dnsZoneTransfer,
+    dnsSubdomainEnum,
+    dnsCacheSnoop,
+    dnsNsecWalk,
+    dnsWildcardDetect,
+    dnsServerFingerprint,
+    dnsRecursiveCheck,
+    dnsPropagation,
+    dnsSplitHorizon,
+    dnsTtlAnalysis,
+];
+//# sourceMappingURL=index.js.map