\n";
include ("header");
print 'Zone record finder
This script tries to discover all well known records in a
given domain and present them in a BIND friendly format.
Whilst primarily aimed at top level domains it may also
return useful results for subdomains
If you want a more general DNS discovery tool you might want
to look at DNSdumpster.
More details about what this tool looks for and the background
behind it can be found in the ScramWorks DNS
discovery article.
Download
record list
';
// do the normal sanity checkign of getting input
if ( $_SERVER['REQUEST_METHOD'] == 'POST' && !empty($_POST['domain']) ) {
$domain=strtolower($_POST['domain']);
} elseif ( $_SERVER['REQUEST_METHOD'] == 'GET' && !empty($_GET['domain']) ) {
$domain=strtolower($_GET['domain']);
}
if ( empty($domain) ) {
include('footer');
exit;
}
$domain=trim($domain);
if ( !filter_var("user@$domain", FILTER_VALIDATE_EMAIL)) {
print 'The domain name ' . $domain . ' appears to be
invalid, or at least liable to make this script unhappy -
sorry.
';
include('footer');
exit;
}
// we need the domain length later
$domlen=strlen($domain);
// Do the SOA seperately for neatness
exec("dig +noall +answer -t soa $domain.",$SOA);
if ( empty($SOA[0])) {
print 'SOA not found for '. $domain . ' exiting
';
include('footer');
exit;
}
$SOA=$SOA[0];
$DNSrr=dns_get_record($domain,DNS_ALL);
$wild=dns_get_record("*.$domain",DNS_ALL);
// Only do stuff if there's a wild card record
if ( !empty($wild) ) {
foreach ( $wild as $rwild ) {
unset($rwild['ttl']);
$zwild[]=$rwild;
}
$DNSrr=array_merge($DNSrr,$zwild);
$twild=$zwild[0];
unset($twild['host']);
}
foreach ( $common as $rr ) {
$rrfound=dns_get_record("$rr.$domain",DNS_ALL);
if ( empty($rrfound) ) {
continue;
}
// Check for matches with wildcard records
if ( !empty($twild) ) {
$wildmatch='';
foreach ( $rrfound as $check ) {
unset($check['host']);
unset($check['ttl']);
if ( $twild == $check ) {
$wildmatch=1;
continue;
}
}
// The record matches the wild card so move on
if ( !empty($wildmatch) ) {
continue;
}
}
$DNSrr=array_merge($DNSrr,$rrfound);
}
foreach ( $DNSrr as $rr ) {
if ( $rr['type'] == "SOA" ) {
continue;
} elseif ( strpos($rr['host'],$domain) === FALSE ) {
continue;
}
unset($rr['ttl']);
unset($rr['entries']);
if ($rr['type'] == "TXT" ) {
$rr['txt']='"' . $rr['txt'] . '"';
}
// check for additonal records
if ( !empty($rr['target']) && strpos($rr['target'],$domain)) {
$additional[]=$rr['target'];
}
$trr='';
$rr['host'] = $rr['host'] . '.';
if ( !empty($rr['target'] ) ) {
$rr['target'] = $rr['target'] . '.';
}
foreach ( $rr as $data ) {
$trr .= "$data ";
}
$zone[]=$trr;
}
// Now deal with the additonal records
foreach ( array_unique($additional) as $rr ) {
$arr=dns_get_record("$rr",DNS_ALL);
if ( empty($arr) ) {
continue;
}
foreach ( $arr as $arr2 ) {
unset($arr2['ttl']);
unset($arr2['entries']);
$trr='';
if ( substr($arr2['host'],-$domlen) != "$domain") {
continue;
}
$arr2['host'] = $arr2['host'] . '.';
if ( !empty($arr2['target']) ) {
$arr2['target'] = $arr2['target'] . '.';
}
foreach ( $arr2 as $data ) {
$trr .="$data ";
}
$zone[]=$trr;
}
}
$rrlist=array_unique($zone);
array_unshift($rrlist,$SOA);
$zonetxt='';
foreach ($rrlist as $rr ) {
$zonetxt .="$rr\n";
}
print '' . count($rrlist) . ' records found for ' . $domain . '
';
print $zonetxt . '
Download
';
include('footer');
?>