#!/usr/bin/perl

use Net::DNS;
use Net::DNS::RR;
use NetAddr::IP;
use LWP::UserAgent;
use Socket;
use HTTP::Request::Common;
use XML::Simple;
use Getopt::Std;

#DNS Hunter By Xianur0
#uxmal666@gmail.com
#Uso: dns.pl [Web] [Opción]

#CONFIGURACION:
#------------------------------------------
$ver = "0.2";
%whoisserver = (
    'com', 'whois.crsnic.net',
    'net', 'whois.crsnic.net',
    'edu', 'whois.crsnic.net',
    'org', 'whois.publicinterestregistry.net',
    'info', 'whois.rotld.ro');
$ua = LWP::UserAgent->new;
my $lib = XMLin("lib.xml");
#-------------------------------------------
print "                                ..::DNS Hunter By Xianur0 Version Fenix (Privada)::..\n\n";
my $host = $ARGV[0];
new NetAddr::IP($host) || die "Error: IP o Dominio Incorrecto!\n";

   my $opt_string = 'whdta';
   whois() if $opt{w};
   uso() if $opt{h};
   dns() if $opt{d};
   http() if $opt{t};
   todo() if $opt{a};

sub dns() {
print "\n[-]Inicio del Scanneo: ". localtime()."\n";
&soa;
&mx;
&txt;
&ns;
&hinfo;
&dnsrotativo;
&any;
&zonas;
print "Fin del Scanneo: ". localtime(). "\n";
}
sub todo() {
whois();
dns();
http();
}
sub uso {
die "[-]Uso: dns.pl [dominio] [opciones]\nOpciones:\n-t HTTP AttackToolKit\n-w Ataque Whois\n-d Ataque DNS\n-a Ejecuta Todo lo Anterior\n";
}
sub dnsrotativo {
print "[-]Buscando DNS Rotativos (Mediante PTR)...:\n";
my $consulta = new NetAddr::IP($host);
&consultar;
my $inicial = $ipaddr;
&consultar;
while($inicial ne $ipaddr) { &consultar; }
}

sub consultar {
my $consulta = new NetAddr::IP($host) || die "Error: IP o Dominio Incorrecto!\n";
my $resolver = Net::DNS::Resolver->new;
my $hosts = $consulta->num();
for (my $i=0; $i<$hosts; ++$i) { $ipaddr = $consulta->addr();
if ($ipaddr) {
my $consulta = $resolver->search("$ipaddr");
if ($consulta) {
foreach my $array ($consulta->answer) {
next unless $array->type eq "PTR";
print "IP: $ipaddr\n","Host: " ,$array->ptrdname, "\n\n"; }
} }}
}

sub soa {
print "[-]Registro SOA:\n";
my $resolver   = Net::DNS::Resolver->new;
my $consulta = $resolver->query($host, "SOA");
if ($consulta) {
 ($consulta->answer)[0]->print;
}
print "\n\n";
}

sub zonas {
if($sdns[0] eq "") { $sdns[0] = $ipaddr;}
foreach $dnsa (@sdns) {
print "[-]Intentando Ataque AXFR....: Usando: $dnsa\n";
my $consulta = Net::DNS::Resolver->new;
$consulta->nameservers($dnsa);
my @zonas = $consulta->axfr($host);
if(!@zonas) { print "No se Logro Obtener Zonas :(..."; &detectarcomodin; } else {
foreach $array (@zonas) {
 $array->print;
} print "\Vulnerado :D!\n\n";}
print "\n\n";
} }

sub ns {
my $consulta   = Net::DNS::Resolver->new;
my $consulta = $consulta->query($host, "NS");
if ($consulta) {
print "[-]Servidores DNS:\n";
 foreach $array (grep { $_->type eq 'NS' } $consulta->answer) {
print $array->nsdname ."\n";
@sdns = (@sdns, $array->nsdname);
 }
}
print "\n\n";
}

sub hinfo {
my $consulta   = Net::DNS::Resolver->new;
my $consulta = $consulta->query($host, "HINFO");
if ($consulta) {
print "\n[-]Registro HINFO:\n";
 foreach $array ($consulta->answer) {
 $array->print;
 }}
print "\n\n";
}

sub mx {
my $resolver   = Net::DNS::Resolver->new;
my $consulta = $resolver->query($host, "MX");
if ($consulta) {
print "\n[-]Servidores de Correo: \n";
 foreach $array ($consulta->answer) {
 $array->print;
}
print "\n";
}
}

sub txt {
my $resolver   = Net::DNS::Resolver->new;
my $consulta = $resolver->query($host, "TXT");
if ($consulta) {
print "\n[-]Registro TXT (Configuracion MX): \n";
 foreach $array ($consulta->answer) {
 $array->print;
}
print "\n\n";
}
}

sub any {
print "[-]Obteniendo informaci�n Extra:\n";
my $resolver   = Net::DNS::Resolver->new;
my $consulta = $resolver->query($host, "ANY");
if ($consulta) {
 foreach $array ($consulta->answer) {
 $array->print;
}}
print "\n\n";
}

sub detectarcomodin {
print "Detectando Comodin en Registros A...\n";
my $consulta = new NetAddr::IP("dnshunter.$host");
if($consulta) { print "\nServidor Protegido contra DNS Brutes Forces...."; &brute2; } else {print "No Se Detecto Comodin :).\n"; &brute;}
}
sub brute {
print "Probando DNS Brutes Forces:\n";
$db = 'db.txt';
my $sub;
open(SUBS, $db) || die "No existe la DB!";
while($sub = ){
chomp($sub);
$remoto = "$sub.$host";
my $consulta = new NetAddr::IP($remoto);
if($consulta) {print "$remoto existe!\n"; &robots;}
}
close(SUBS);
}
sub brute2 {
print "Iniciando Fase 2....\n";
$url = "detectarcomodinesenlosregistroshost.$host";
$req = HTTP::Request->new(GET => $url);
&headers;
$res = $ua->request($req);
$estado = $res->code;

if ($estado != ""){
print "Servidor Protegido Contra Brutes Forces en el Header Host del HTTP :(...\n";
}
else {print "No se detecto Proteccion en el HTTP :)..\n"; &brute3; }
}

sub headers {
$req->header('Accept' => 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5');
$req->header('Accept-Language' => 'es-es,es;q=0.8,en-us;q=0.5,en;q=0.3');
$req->header('Keep-Alive' => '300');
$req->header('Connection' => 'keep-alive');
$req->header('Accept-Charset' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7');
}
sub brute3 {
$db = 'db.txt';
my $sub;
open(SUBS, $db) || die "No existe la DB!";
while($sub = ){
chomp($sub);
$remoto = "$sub.$host";
my $proto = getprotobyname('tcp');
my $ipaddr = inet_aton($remoto);
my $paddr = sockaddr_in(80, $ipaddr);
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
$conected = connect(SOCKET, $paddr);
close SOCKET;
if ($conected) {
print "$remoto Existe!\n";
}
}
close(SUBS);
}
sub robots {
$req = HTTP::Request->new(GET => "http://$host/robots.txt");
&headers;
$res = $ua->request($req);
if ($res->is_success) {
if($res->content_type eq 'text/plain') {
print "--------------------------------------------------------------------------------------\n".$res->content."\n--------------------------------------------------------------------------------------\n";
}
}
}
sub http() {
use IO::Socket;
print "\n[-]HTTP Attack ToolKit: \n\n";
my $sock = new IO::Socket::INET ( PeerAddr => $host, PeerPort => 80, Proto => 'tcp',  Timeout=>'1', );
if(!$sock) {print "No se Pudo Conectar a $host!\n"; } else {
print $sock "OPTIONS / HTTP/1.1\nHost: $host\n\n";
print "-----------------------Headers--------------------------\n";
while ($linea = <$sock>) {
if ($linea =~  "HTTP/1.") {
print "Estado De Respuesta: ".$linea;
}
if ($linea =~  /Server:/) {
print $linea;
for( @{$lib->{server}} ) {
if ($linea =~  "$_->{banner}") { print "$_->{nombre}\n"; }
}
}
for( @{$lib->{header}} ) {
if ($linea =~  "$_->{banner}") {
if($linea !~ "<") { my @header = split(": ", $linea); print "$_->{nombre}".$header[1];
}
}
}
}
close($sock);
print "-------------------------------------------------\n\n";
#PUT
my $sock = new IO::Socket::INET ( PeerAddr => $host, PeerPort => 80, Proto => 'tcp',  ); die "No se Pudo Conectar a $host!\n" unless $sock;
print $sock "PUT /hacked.htm HTTP/1.1\nHost: $host\nContent-Length: 38\n\r\n\r
Vulnerado por DNS Hunter 0.2
\n\r\n\r";
@linea = (<$sock>);
for( @{$lib->{estado}} ) {
if ($linea[0] =~  $_->{numero}) {
print "[-]Vulnerable a PUT!!....\n      Estado de Respuesta: $_->{numero}\n\n";
}
}
close($sock);
#TRACE
my $sock = new IO::Socket::INET ( PeerAddr => $host, PeerPort => 80, Proto => 'tcp', Timeout=>'10', ); die "No se Pudo Conectar a $host!\n" unless $sock;
print $sock "TRACE / HTTP/1.1\nHost: $host\n\r\n\r";
while ($linea = <$sock>) {
if ($linea =~  "message/http") {
print "[-]Vulnerable a TRACE!.....:\nCodigo XST de Demostracion:.\n------------------------------------------\n\n------------------------------------------\n\n";
}
 }
close($sock);
#DELETE
my $sock = new IO::Socket::INET ( PeerAddr => $host, PeerPort => 80, Proto => 'tcp',  Timeout=>'10', ); die "No se Pudo Conectar a $host!\n" unless $sock;
print $sock "DELETE /hacked.htm HTTP/1.1\nHost: $host\n\r\n\r";
@linea = (<$sock>);
for( @{$lib->{estado}} ) {
if ($linea[0] =~  $_->{numero}) {
print "[-]Vulnerable a DELETE!!....\n      Estado de Respuesta: $_->{numero}\n\n";
}
}
close($sock);
}}

sub whois() {
my @hosts = split(/\./, $host);
$extencion = pop(@hosts);
$whoisserver = $whoisserver{$extencion};
if($whoisserver eq "") {print "Whois No Disponible para la Extencion: $extencion";} else {
my $sock = new IO::Socket::INET ( PeerAddr => $whoisserver, PeerPort => 43, Proto => 'tcp',  Timeout=>'10', );
print $sock "=".$host."\n";
print "\n[-]Whois ($whoisserver): \n-----------------------------------------------------\n\n";
while ($linea = <$sock>) {
if($linea =~ $host) {
print "Server: $linea";
}
if($linea =~ "Whois Server") {
my @dato = split(": ", $linea);
chop($dato[1]);
my $who = new IO::Socket::INET ( PeerAddr =>$dato[1], PeerPort => 43, Proto => 'tcp',  Timeout=>'10', );
if(!$who) { print "[-]Server Whois Down!\n"; } else {
print $who $host."\n";
print "\n[-]\n\n"; while($whos = <$who>)  { print $whos; }
print "\n\n[-]\n\n";
}} else {
for( @{$lib->{whois}} ) {
if ($linea =~  "$_->{etiqueta}") {
my @dato = split(": ", $linea);
print "$_->{imprimir}".$dato[1]; }
}
}}
print "\n-----------------------------------------------------\n\n";
}}