flareguard 0.1.0

package/src/origin/dns.rs

@@ -0,0 +1,177 @@
+use crate::origin::error::{HunterError, Result};
+use hickory_resolver::TokioResolver;
+use hickory_resolver::proto::rr::{RData, RecordType};
+use ipnet::Ipv4Net;
+use regex::Regex;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::str::FromStr;
+use std::sync::OnceLock;
+
+/// Creates a new asynchronous DNS resolver configured with system resolver and fallback
+pub fn create_resolver() -> Result<TokioResolver> {
+    TokioResolver::builder_tokio()
+        .map_err(|e| HunterError::Dns(e.to_string()))?
+        .build()
+        .map_err(|e| HunterError::Dns(e.to_string()))
+}
+
+/// Resolves A (IPv4) and AAAA (IPv6) records for a domain
+pub async fn resolve_ips(resolver: &TokioResolver, domain: &str) -> Result<Vec<IpAddr>> {
+    let mut results = Vec::new();
+
+    if let Ok(response) = resolver.lookup_ip(domain).await {
+        for ip in response.iter() {
+            if !results.contains(&ip) {
+                results.push(ip);
+            }
+        }
+    }
+
+    Ok(results)
+}
+
+/// Resolves MX records for a domain and looks up the IP addresses of the mail exchangers
+pub async fn resolve_mx_servers(
+    resolver: &TokioResolver,
+    domain: &str,
+) -> Result<Vec<(String, Vec<IpAddr>)>> {
+    let mut servers = Vec::new();
+
+    if let Ok(lookup) = resolver.lookup(domain, RecordType::MX).await {
+        for record in lookup.answers() {
+            if let RData::MX(ref mx) = record.data {
+                let exchange = mx.exchange.to_utf8().trim_end_matches('.').to_string();
+                let ips = resolve_ips(resolver, &exchange).await.unwrap_or_default();
+                servers.push((exchange, ips));
+            }
+        }
+    }
+
+    Ok(servers)
+}
+
+/// Resolves TXT records for a domain
+pub async fn resolve_txt_records(resolver: &TokioResolver, domain: &str) -> Result<Vec<String>> {
+    let mut records = Vec::new();
+
+    if let Ok(lookup) = resolver.lookup(domain, RecordType::TXT).await {
+        for record in lookup.answers() {
+            if let RData::TXT(ref txt) = record.data {
+                let text = txt
+                    .txt_data
+                    .iter()
+                    .map(|b| String::from_utf8_lossy(b).into_owned())
+                    .collect::<Vec<_>>()
+                    .join("");
+                records.push(text);
+            }
+        }
+    }
+
+    Ok(records)
+}
+
+/// Resolves NS records for a domain
+pub async fn resolve_ns_records(resolver: &TokioResolver, domain: &str) -> Result<Vec<String>> {
+    let mut records = Vec::new();
+
+    if let Ok(lookup) = resolver.lookup(domain, RecordType::NS).await {
+        for record in lookup.answers() {
+            if let RData::NS(ref ns) = record.data {
+                let ns_str = ns.0.to_utf8().trim_end_matches('.').to_string();
+                records.push(ns_str);
+            }
+        }
+    }
+
+    Ok(records)
+}
+
+static SPF_IP4_REGEX: OnceLock<Regex> = OnceLock::new();
+static SPF_IP6_REGEX: OnceLock<Regex> = OnceLock::new();
+
+fn get_spf_ip4_regex() -> &'static Regex {
+    SPF_IP4_REGEX.get_or_init(|| Regex::new(r"(?i)ip4:([0-9\.\/]+)").unwrap())
+}
+
+fn get_spf_ip6_regex() -> &'static Regex {
+    SPF_IP6_REGEX.get_or_init(|| Regex::new(r"(?i)ip6:([0-9a-fA-F:\/]+)").unwrap())
+}
+
+/// Extracts IPv4 and IPv6 addresses specified directly in an SPF record
+pub fn extract_ips_from_spf(spf_text: &str) -> Vec<IpAddr> {
+    let mut ips = Vec::new();
+
+    if !spf_text.to_lowercase().contains("v=spf1") {
+        return ips;
+    }
+
+    // Match ip4:
+    let ip4_re = get_spf_ip4_regex();
+    for cap in ip4_re.captures_iter(spf_text) {
+        if let Some(matched) = cap.get(1) {
+            let val = matched.as_str();
+            if val.contains('/') {
+                if let Ok(net) = Ipv4Net::from_str(val) {
+                    let addr = IpAddr::V4(net.addr());
+                    if !ips.contains(&addr) {
+                        ips.push(addr);
+                    }
+                }
+            } else if let Ok(ip) = Ipv4Addr::from_str(val) {
+                let addr = IpAddr::V4(ip);
+                if !ips.contains(&addr) {
+                    ips.push(addr);
+                }
+            }
+        }
+    }
+
+    // Match ip6:
+    let ip6_re = get_spf_ip6_regex();
+    for cap in ip6_re.captures_iter(spf_text) {
+        if let Some(matched) = cap.get(1) {
+            let val = matched.as_str();
+            let cleaned = val.split('/').next().unwrap_or(val);
+            if let Ok(ip) = Ipv6Addr::from_str(cleaned) {
+                let addr = IpAddr::V6(ip);
+                if !ips.contains(&addr) {
+                    ips.push(addr);
+                }
+            }
+        }
+    }
+
+    ips
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_extract_ips_from_spf() {
+        let spf = "v=spf1 ip4:198.51.100.42 ip4:203.0.113.0/24 ip6:2001:db8::1 include:_spf.google.com ~all";
+        let ips = extract_ips_from_spf(spf);
+
+        assert_eq!(ips.len(), 3);
+        assert!(ips.contains(&"198.51.100.42".parse().unwrap()));
+        assert!(ips.contains(&"203.0.113.0".parse().unwrap()));
+        assert!(ips.contains(&"2001:db8::1".parse().unwrap()));
+    }
+
+    #[test]
+    fn test_extract_ips_from_non_spf() {
+        let txt = "google-site-verification=abcdef123456";
+        let ips = extract_ips_from_spf(txt);
+        assert!(ips.is_empty());
+    }
+
+    #[test]
+    fn test_extract_ips_single_ip4() {
+        let spf = "v=spf1 a mx ip4:45.33.32.156 -all";
+        let ips = extract_ips_from_spf(spf);
+        assert_eq!(ips.len(), 1);
+        assert_eq!(ips[0], "45.33.32.156".parse::<IpAddr>().unwrap());
+    }
+}

package/src/origin/enumerator.rs

@@ -0,0 +1,271 @@
+use crate::origin::cloudflare::{is_cloudflare_ip, partition_ips};
+use crate::origin::crtsh::query_crtsh;
+use crate::origin::dns::{
+    extract_ips_from_spf, resolve_ips, resolve_mx_servers, resolve_ns_records, resolve_txt_records,
+};
+use crate::origin::error::Result;
+use crate::origin::models::{CandidateIp, DiscoverySource};
+use futures::stream::{self, StreamExt};
+use hickory_resolver::TokioResolver;
+use reqwest::Client;
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::path::Path;
+
+pub const DEFAULT_SUBDOMAINS: &[&str] = &[
+    "direct",
+    "origin",
+    "mail",
+    "cpanel",
+    "ftp",
+    "dev",
+    "staging",
+    "portal",
+    "admin",
+    "api-origin",
+    "backend",
+    "internal",
+    "vps",
+    "server",
+    "ssh",
+    "mx",
+    "autodiscover",
+    "webmail",
+    "test",
+    "beta",
+    "stage",
+    "corp",
+    "vpn",
+    "ns1",
+    "ns2",
+    "smtp",
+    "imap",
+    "pop3",
+    "git",
+    "jenkins",
+    "status",
+    "monitor",
+    "app-origin",
+    "gateway",
+    "remote",
+    "intranet",
+    "whm",
+    "webdisk",
+    "secure",
+    "preview",
+    "old",
+    "legacy",
+    "demo",
+];
+
+/// Options for configuring candidate origin enumeration
+#[derive(Debug, Clone)]
+pub struct EnumeratorOptions {
+    pub concurrency: usize,
+    pub enable_crtsh: bool,
+    pub enable_subdomains: bool,
+    pub enable_dns: bool,
+    pub custom_wordlist: Option<Vec<String>>,
+    pub timeout_secs: u64,
+}
+
+impl Default for EnumeratorOptions {
+    fn default() -> Self {
+        Self {
+            concurrency: 10,
+            enable_crtsh: true,
+            enable_subdomains: true,
+            enable_dns: true,
+            custom_wordlist: None,
+            timeout_secs: 5,
+        }
+    }
+}
+
+/// Reads a custom wordlist from file
+pub fn load_wordlist_file(path: &Path) -> Result<Vec<String>> {
+    let content = std::fs::read_to_string(path)?;
+    let list: Vec<String> = content
+        .lines()
+        .map(|l| l.trim().to_lowercase())
+        .filter(|l| !l.is_empty() && !l.starts_with('#'))
+        .collect();
+    Ok(list)
+}
+
+/// Discovers candidate origin IPs for a target domain across subdomains, DNS, and Certificate Transparency
+pub async fn enumerate_candidate_ips(
+    domain: &str,
+    resolver: &TokioResolver,
+    http_client: &Client,
+    options: &EnumeratorOptions,
+) -> Result<Vec<CandidateIp>> {
+    let mut candidate_map: HashMap<IpAddr, CandidateIp> = HashMap::new();
+    let root = domain.trim().to_lowercase();
+
+    // 1. Direct Domain Baseline Partitioning
+    if let Ok(root_ips) = resolve_ips(resolver, &root).await {
+        let (_cf_ips, non_cf) = partition_ips(&root_ips);
+        for ip in non_cf {
+            candidate_map.insert(
+                ip,
+                CandidateIp {
+                    ip,
+                    source: DiscoverySource::DirectDns(root.clone()),
+                    hostname: Some(root.clone()),
+                    is_cloudflare: false,
+                    notes: vec![
+                        "Apex / Root domain A/AAAA record points directly to non-Cloudflare IP"
+                            .into(),
+                    ],
+                },
+            );
+        }
+    }
+
+    // 2. DNS Records Check (MX, SPF, TXT, NS)
+    if options.enable_dns {
+        // MX Records
+        if let Ok(mx_list) = resolve_mx_servers(resolver, &root).await {
+            for (exchange, ips) in mx_list {
+                for ip in ips {
+                    if !is_cloudflare_ip(&ip) {
+                        candidate_map.entry(ip).or_insert_with(|| CandidateIp {
+                            ip,
+                            source: DiscoverySource::MxRecord(exchange.clone()),
+                            hostname: Some(exchange.clone()),
+                            is_cloudflare: false,
+                            notes: vec![format!("Discovered via MX exchange {}", exchange)],
+                        });
+                    }
+                }
+            }
+        }
+
+        // TXT and SPF Records
+        if let Ok(txt_records) = resolve_txt_records(resolver, &root).await {
+            for txt in &txt_records {
+                let spf_ips = extract_ips_from_spf(txt);
+                for ip in spf_ips {
+                    if !is_cloudflare_ip(&ip) {
+                        candidate_map.entry(ip).or_insert_with(|| CandidateIp {
+                            ip,
+                            source: DiscoverySource::SpfRecord(txt.clone()),
+                            hostname: None,
+                            is_cloudflare: false,
+                            notes: vec!["Extracted from SPF policy declaration".into()],
+                        });
+                    }
+                }
+            }
+        }
+
+        // NS Records
+        if let Ok(ns_records) = resolve_ns_records(resolver, &root).await {
+            for ns in ns_records {
+                if let Ok(ips) = resolve_ips(resolver, &ns).await {
+                    for ip in ips {
+                        if !is_cloudflare_ip(&ip) {
+                            candidate_map.entry(ip).or_insert_with(|| CandidateIp {
+                                ip,
+                                source: DiscoverySource::DirectDns(format!("NS: {}", ns)),
+                                hostname: Some(ns.clone()),
+                                is_cloudflare: false,
+                                notes: vec![format!("Discovered via Nameserver {}", ns)],
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    // 3. Subdomain Wordlist Enumeration
+    if options.enable_subdomains {
+        let subdomains_to_check: Vec<String> = match &options.custom_wordlist {
+            Some(custom) => custom.clone(),
+            None => DEFAULT_SUBDOMAINS.iter().map(|&s| s.to_string()).collect(),
+        };
+
+        let fqdns: Vec<String> = subdomains_to_check
+            .into_iter()
+            .map(|sub| {
+                if sub.contains('.') {
+                    sub
+                } else {
+                    format!("{}.{}", sub, root)
+                }
+            })
+            .collect();
+
+        let concurrency = options.concurrency.max(1);
+        let stream = stream::iter(fqdns).map(|fqdn| {
+            let res = resolver.clone();
+            async move {
+                let ips = resolve_ips(&res, &fqdn).await.unwrap_or_default();
+                (fqdn, ips)
+            }
+        });
+
+        let mut buffered = stream.buffer_unordered(concurrency);
+        while let Some((fqdn, ips)) = buffered.next().await {
+            for ip in ips {
+                if !is_cloudflare_ip(&ip) {
+                    candidate_map.entry(ip).or_insert_with(|| CandidateIp {
+                        ip,
+                        source: DiscoverySource::Subdomain(fqdn.clone()),
+                        hostname: Some(fqdn.clone()),
+                        is_cloudflare: false,
+                        notes: vec![format!("Subdomain {} resolved to unmasked IP", fqdn)],
+                    });
+                }
+            }
+        }
+    }
+
+    // 4. Certificate Transparency Logs (crt.sh)
+    if options.enable_crtsh
+        && let Ok(sans) = query_crtsh(http_client, &root, options.timeout_secs).await {
+            let stream = stream::iter(sans).map(|san| {
+                let res = resolver.clone();
+                async move {
+                    let ips = resolve_ips(&res, &san).await.unwrap_or_default();
+                    (san, ips)
+                }
+            });
+
+            let mut buffered = stream.buffer_unordered(options.concurrency.max(1));
+            while let Some((san, ips)) = buffered.next().await {
+                for ip in ips {
+                    if !is_cloudflare_ip(&ip) {
+                        candidate_map.entry(ip).or_insert_with(|| CandidateIp {
+                            ip,
+                            source: DiscoverySource::CertificateTransparency(san.clone()),
+                            hostname: Some(san.clone()),
+                            is_cloudflare: false,
+                            notes: vec![format!("crt.sh SAN {} resolved to unmasked IP", san)],
+                        });
+                    }
+                }
+            }
+        }
+
+    let mut result: Vec<CandidateIp> = candidate_map.into_values().collect();
+    result.sort_by_key(|c| c.ip);
+    Ok(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_default_subdomains_list() {
+        assert!(DEFAULT_SUBDOMAINS.contains(&"origin"));
+        assert!(DEFAULT_SUBDOMAINS.contains(&"direct"));
+        assert!(DEFAULT_SUBDOMAINS.contains(&"cpanel"));
+        assert!(DEFAULT_SUBDOMAINS.contains(&"mail"));
+        assert!(DEFAULT_SUBDOMAINS.contains(&"dev"));
+        assert!(DEFAULT_SUBDOMAINS.contains(&"staging"));
+    }
+}

package/src/origin/error.rs

@@ -0,0 +1,19 @@
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum HunterError {
+    #[error("DNS error: {0}")]
+    Dns(String),
+    #[error("HTTP error: {0}")]
+    Http(#[from] reqwest::Error),
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+    #[error("JSON error: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("Invalid target domain: {0}")]
+    InvalidTarget(String),
+    #[error("Other error: {0}")]
+    Other(String),
+}
+
+pub type Result<T> = std::result::Result<T, HunterError>;