manpages

massdns(1)

massdns(1) massdns man page massdns(1)

NAME

massdns - high-performance DNS stub resolver for bulk lookups and reconnaissance

SYNOPSIS

massdns [options] -r resolvers.txt domains.txt

DESCRIPTION

massdns is a high-performance DNS stub resolver.

It is targeting researchers performing internet measurements and bug bounty hunters leveraging it for subdomain enumeration during their reconnaissance process. Being a stub resolver, massdns relies on third-party resolvers to perform recursive lookups. massdns is written in C and does not make use of threads. Instead, it uses epoll on Linux to handle communication concurrently. The number of concurrent lookups is user-controlled. All DNS requests are made using UDP.

COMMAND-LINE OPTIONS

massdns currently does not follow POSIX convention recommendations. All command line arguments and their values have to be separated by spaces.

-b --bindto

IP addresses for massdns query sockets. When this option is not specified, massdns will bind to 0.0.0.0:0, causing the operating pick an appropriate IP address and port. If this option is specified multiple times, a query socket for each address is created. When sending a query, a socket is then selected at random.

--busy-poll

Instead of using epoll, massdns will make use of busy-waiting. This is a non-configurable default on non-Linux platforms, where epoll is not available. This is not very efficient, so you should refrain from using this option in most cases.

-c --resolve-count

This value is an integer that specifies how often massdns attempts to resolve a name. A failure reason can either be due to a timeout (as specified by -i) or an unacceptable response code (as specified by --retry). For reliable resolvers and when a appropriate concurrency value is set, this value can be quite low. The default value is 50, which is very high.

--drop-user
This option is only relevant when you run the program as root, which is not recommended for security reasons. In this case, privileges will be dropped to the specified user. If this option is not specified, this will be the nobody user if it exists on the system. If --drop-group is not specified, the group will be set to the main group of the specified user, which is nogroup for nobody.

--drop-group

When being run as root, set the group to this value instead of the main group of the user specified by --drop-user

--extended-input

By default, massdns treats each input line as a query. When this option is specified, a line will be treated as a query separated from resolver addresses by a space. Instead of "example.com", an input line can then be "example.com 1.1.1.1 8.8.8.8:53", causing the program to attempt to resolve example.com via 1.1.1.1 and 8.8.8.8 before falling back to the resolver list. Port specification is optional. By default, DNS port 53 is used.

--filter

This option defines a DNS response code whitelist of packets to be printed. It can be specified multiple times. For example, --filter NXDOMAIN --filter REFUSED will only print packets with the specified codes. DNS response codes can either specified textually or numerically. This option and --ignore are mutually exclusive.

--flush

This option causes the output stream to be flushed whenever a response was written.

--help

Shows a help text that is more compressed than this man page.

--ignore

In contrast to --filter , this option defines a blacklist.

-i --interval

This option specifies an timeout in milliseconds to wait between multiple resolves of the same domain. The default value is 500.

-l --error-log

Instead of logging to /dev/stderr, log to the specified file. This is useful because the status output can be quite noisy and cause errors to be overlooked when printed to stderr as well.

--norecurse

DNS has a flag called RD, which is short for "Recursion Desired". By default, massdns assumes that you want to use it with recursive resolvers, so it will set this bit. Sometimes, for example when performing DNS cache snooping, you may want to unset this bit. You may also want to unset this bit when performing subdomain enumeration against authoritative nameservers.

-o --output

This option specifies the output format. The first character specifies the general output class, such as whether to output JSON, human-readable full-text or binary data. The following characters specify advanced output flags that are specific to this output class.

The following output classes are supported:

L - list output

Only output the query names of response packets, i.e. effectively only output domains.

Advanced output flags:
0 - By default, the list output mode will only output query names of packets that have at least one answer record. When this flag is enabled, the list output will also output NOERROR packets without answers. This is particularly useful for performing subdomain enumeration against some nameservers, where a NOERROR code might give away that another record type than the queried one exists for the DNS name.

S - simple text output

Due to the multitude of advanced flags that have accumulated over time, the "simple text output" has become less simple. It now supports many flags that allow for an advanced customization of the output. Really, you should probably use JSON instead. By default, this output mode outputs all resource records of the DNS answer section that match the question name. Each record will be on a separate line. If any advanced output flag has been specified, this output mode will also print resource records that do not match the question name, unless specified otherwise by the advanced output flag m.

Advanced output flags:
d - Include records from the additional section. As the simple text output outputs records from the answer section by default, enabling this flag will only output records from the additional section, unless the output of records from other sections is explicitly turned on.

i - Indent resource records with a tab. This is especially useful when the DNS question is printed.

m - Only output resource records that match the question name.

n - Include records from the answer section. This option works analogously to the d option.

q - Instead of only outputting resource records, also output the DNS question.

r - Print the question with resolver IP address, Unix timestamp and response code prepended. This flag implies the q flag.

s - Print an additional newline character after each DNS packet.

t - Include TTL and record class within the output.

u - Include records from the authority section. This option works analogously to the d option.

F - full text output

This output mode is not customizable and outputs all successful responses in the style of the dig tool.

F - binary output

The uncustomizable binary format has no binding specification but follows from the source code. The repository includes a dnsparse.py script that is kept up to date with the binary format as output by massdns.

J - NDJSON (new-line delimited JSON)

This output causes each response packet to be printed as a JSON object.

Advanced output flags:
e - Instead of only writing JSON objects for successful resolves, also write a record for each terminal failure, such as a final timeout or a final unacceptable response code.

Note that not all record types are supported. Only the binary output mode allows you to preserve the content of all records as it writes raw DNS packets to the output stream. The following record types are currently supported in non-binary output modes: A, AAAA, CAA, CNAME, DNAME, MX, NS, SRV, PTR, SOA, TXT

--predictable

By default, the resolver for a query will be picked randomly for each transmission. If this option is specified, the resolver will be picked in a deterministic, predictable manner. The first query will use the first resolver from the list, the second query will use the second one and so on (modulo the number of resolvers). This can be leveraged to conduct resolver tests.

--processes

In case resolving with a single process is not fast enough, you can use more than one process. This option specifies the number of processes to be used, so the default value is 1. When multiple processes are used, -w needs to be specified. massdns will then fork and write the output of each process to a different file, following a shared-nothing approach.

--quiet

When this option is specified, massdns will not print progress stats and it will not display some warnings.

--rand-src-ipv6

When this option is supplied with an IPv6 subnet in CIDR notation, massdns will use a raw UDP socket for IPv6 resolvers. For each query, a random IP address from the subnet is used. This allows to bypass rate limits for some public IPv6 resolvers. It will only work if your machine is provided with a routed prefix and can use addresses from within its subnet without neighbor discovery.

--rcvbuf

Size of the receive buffer of the query socket(s) in bytes.

-r --resolvers

File containing the list of resolvers/nameservers to be used. Each line should contain an IPv4 or IPv6 address. Specifying ports (using a colon, together with square brackets in case of IPv6 addresses) is optional. By default, DNS port 53 will be used.

--retry

This option specifies the DNS response codes that are considered a failure and cause a lookup to be retried. By default, massdns will retry lookups for all responses without NOERROR or NXDOMAIN response code. As soon as this option is specified, it will behave as a whitelist for retries. This is useful because some resolvers will return codes such as REFUSED or SERVFAIL once you hit internal rate limits. When performing subdomain enumeration, you do not want to miss responses in this case, so they are retried automatically.

This option accepts DNS response codes in textual or numeric format. Additionally, it supports the special value "never", which instructs massdns to never consider any valid DNS response to be unacceptable. This would be a reasonable setting when working with reliable, trusted resolvers.

--root

Do not drop the privileges when running as root. For security reasons, using this option is not recommended.

-s --hashmap-size

This option accepts an integer that controls the number of concurrent lookups and thus the lookup rate. When being too low, the available network performance is not exhausted. When being too high, it may overload resolvers or cause network congestion.

Internally, massdns makes use of a hash map which stores information about ongoing lookups. Thus, this option defines the number of ongoing lookups. When all slots of the hash map are occupied, the next lookup will take place as soon as one lookup times out (as specified by --i) or returns an unacceptable response (as specified by --retry).

The value of this option is directly correlated with the number of successful lookups per second. Consider a single, non-rate-limiting name server with an average RTT of ca. 10ms. A value of 1 for this option can then already reach about 100 successful lookups per second. The default value of this option is 10,000.

This option supports the special value "auto", which aims to adjust the concurrency automatically. At the moment, the "auto" feature doubles the number of concurrent lookups until timeouts are observed. Thus, this feature is experimental and useful only when all resolvers are 100 % reliable, e.g. in case they are authoritative.

--sndbuf

Size of the send buffer of the query socket(s) in bytes.

--status-fmt

This option can be either "json" or "ansi". When it is not specified, it defaults to "ansi", causing massdns to print out stats in human-readable format to stderr. In case you want to automate the use of massdns, you may want to use "json" to parse the output.

--sticky

Without this option, each lookup (including its retries) will pick a resolver at random. With this option, retries will stick to the same resolver.

--socket-count

If --bindto has not been specified, this option controls the number of query sockets to use per IP version.

-t --type

The DNS record type to be queried for. When this option is not present, the default value is "A". This option can be specified multiple times to query for multiple record types. Record types you may want to query include, but are not limited to, A, AAAA, MX, NS, TXT.

--verify-ip

By default, massdns will not verify incoming IP addresses. This option enables source IP verification of incoming packets.

-w --outfile

Instead of writing results to stdout, write them to the file specified by this option.

WEBSITE

https://github.com/blechschmidt/massdns

2021 1.0.0