source: fierce2/branch/lib/Fierce/Domain/tBruteForceDNS.pm @ 120

use threads;
use threads::shared;

# $Id$
package tBruteForceDNS;
{
    use Object::InsideOut qw(:SHARED AttackObj);
    use Data::Dumper;
    use Fierce::Base;
    use Fierce::Domain;
    use Socket;
    use Thread::Queue;
    use Net::hostent;
    use Data::Validate::IP qw(is_public_ipv4 is_ipv4);

    ### required parameters
    # none

    ## optional parameters
    # prefixes to use during bruteforce
    my @prefix_list : Field : Arg(prefix_list) : Get(prefix_list) :
        Type(Array) :
        Default( ['imap','www', 'mail', 'files', 'file', 'ftp', 'dns','smtp', 'ns', 'mx', 'dev', 'devel', 'svn', 'cvs', 'test', 'vpn', 'unix', 'webmail'] );

    # max number of interation to use for bruteforce attempts
    my @max_bruteforce : Field : Arg(max_bruteforce) : Get(max_bruteforce) :
        Default(5);

    # contiue to perform bruteforce if a wildcard is being used
    my @test_with_wildcard : Field : Arg(test_with_wildcard) :
        All(test_with_wildcard) : Default(0);

    # Base Configuration infomation
    my @base : Field : Arg(base) : All(base) : Type(Base);

    ### populated parameters
    # list of nodes found
    my @result : Field : Arg(result) : All(result) : Type(List(Node)) :
        Default([]);

    # domain object from execute
    my @domain_obj : Field : Arg(domain_obj) : All(domain_obj) : Type(Domain);

    # initialize the base obj
    sub _init : Init {
        my ($self) = @_;

        # Set default if needed
        if ( !exists( $base[$$self] ) ) {
            $self->set( \@base, Base->new() );
        }
    }

    # execute: Domain -> Fierce::Domain::tBruteForceDNS
    # kicks off the dns bruteforce worker threads
    sub execute {
        my ( $self, $domain_obj ) = @_;

        $self->_setup;
        $self->domain_obj($domain_obj);

        my $stream = Thread::Queue->new();

        foreach my $prefix ( @{ $self->prefix_list } ) {
            $stream->enqueue($prefix);
        }
        my $base = $self->base;
        foreach ( 1 .. $base->threads ) {
            threads->new( \&thr_work, $self, $stream );
            $stream->enqueue(undef);    # for each thread
        }
        foreach my $thr ( threads->list() ) {
            $thr->join();
        }
        $self->_complete;
        return $self;
    }

    # thr_work: Thread::Queue ->
    # perform dns bruteforce using prefix and url
    sub thr_work {
        my ( $self, $q ) = @_;
        my $domain = $self->domain_obj->domain;
        my $base   = $base[$$self];
        #print( 'Thread = ', threads->tid(), "\n" );
        sleep( $base->delay() );

        while ( my $prefix = $q->dequeue() ) {
            my $i    = 2;
            my $max  = $self->max_bruteforce + 2;
            chomp($prefix);
            #print "testing $prefix.$domain\n";
            my $inet = inet_aton("$prefix.$domain");

            # checking to see if prefix1 resolves
            if ( !defined $inet ) {
                $prefix .= "1";
                $inet = inet_aton("$prefix.$domain");
            }

            # checking to see if prefix01 resolves
            if ( !defined $inet ) {
                $prefix =~ s/1$//g;
                $prefix .= "01";
                $inet = inet_aton("$prefix.$domain");
            }
            
            if ( defined $inet and is_public_ipv4(inet_ntoa($inet)) ) {
                my $node = Node->new(
                    hostname => "$prefix.$domain",
                    ip       => inet_ntoa($inet),
                    from     => 'DNS Prefix BruteForece'
                );
                push( @{ $result[$$self] }, $node );
                my $wildcard_dns = 1e11 - int( rand(1e10) ) . "." . $domain;
                my $h            = gethost("$wildcard_dns");
                if ( !$h or $self->test_with_wildcard == 1 ) {
                    $prefix =~ s/01$|1$//g;
                    while ( $i <= $max ) {
                        my $num = $i;

               # checking to see if prefix"NUMBER" or prefix"0NUMBER" resolves
                        $inet = inet_aton("$prefix$num.$domain");
                        if ( !defined $inet ) {
                            $num  = "0$i";
                            $inet = inet_aton("$prefix$num.$domain");
                        }

                        if ( defined $inet ) {
                            my $node = Node->new(
                                hostname => "$prefix$num.$domain",
                                ip       => inet_ntoa($inet),
                                from     => 'DNS Prefix BruteForece'
                            );
                            push( @{ $result[$$self] }, $node );
                            $max++;
                        }
                        $i++;
                    }
                }
            }

            # Let others run
            threads->yield();
        }
    }
}

1;