[英]Increasing Ruby Resolv Speed
我正在嘗試構建一個子域強盜,以便與我的客戶一起使用 - 我從事安全/筆測試工作。 目前,我能夠讓Resolv在10秒內查找大約70個主機,給予或接受並想知道是否有辦法讓它做更多。 我已經看到了替代腳本,主要是基於Python,可以實現比這更快的速度。 我不知道如何增加Resolv並行發出的請求數,或者我是否應該將列表拆分。 請注意我已將Google的DNS服務器放在示例代碼中,但將使用內部的DNS服務器進行實時使用。
我調試此問題的粗略代碼是:
require 'resolv'
def subdomains
puts "Subdomain enumeration beginning at #{Time.now.strftime("%H:%M:%S")}"
subs = []
domains = File.open("domains.txt", "r") #list of domain names line by line.
Resolv.new(:nameserver => ['8.8.8.8', '8.8.4.4'])
File.open("tiny.txt", "r").each_line do |subdomain|
subdomain.chomp!
domains.each do |d|
puts "Checking #{subdomain}.#{d}"
ip = Resolv.new.getaddress "#{subdomain}.#{d}" rescue ""
if ip != nil
subs << subdomain+"."+d << ip
end
end
end
test = subs.each_slice(4).to_a
test.each do |z|
if !z[1].nil? and !z[3].nil?
puts z[0] + "\t" + z[1] + "\t\t" + z[2] + "\t" + z[3]
end
end
puts "Finished at #{Time.now.strftime("%H:%M:%S")}"
end
subdomains
domains.txt是我的客戶域名列表,例如google.com,bbc.co.uk,apple.com和'tiny.txt'是潛在的子域名列表,例如ftp,www,dev,files,上傳。 然后Resolv會查找files.bbc.co.uk,讓我知道它是否存在。
有一件事是你用Google名稱服務器創建一個新的Resolv實例,但從不使用它; 您創建一個全新的Resolv實例來執行getaddress調用,因此該實例可能使用一些默認的名稱服務器而不是Google的名稱服務器。 您可以將代碼更改為以下內容:
resolv = Resolv.new(:nameserver => ['8.8.8.8', '8.8.4.4'])
# ...
ip = resolv.getaddress "#{subdomain}.#{d}" rescue ""
另外,我建議使用File.readlines方法來簡化代碼:
domains = File.readlines("domains.txt").map(&:chomp)
subdomains = File.readlines("tiny.txt").map(&:chomp)
此外,你正在搶救壞的ip並將其設置為空字符串,但是在下一行中你測試的不是nil,所以所有的結果都應該通過,我認為這不是你想要的。
我重構了你的代碼,但沒有對它進行測試。 這是我想出來的,可能更清楚:
def subdomains
puts "Subdomain enumeration beginning at #{Time.now.strftime("%H:%M:%S")}"
domains = File.readlines("domains.txt").map(&:chomp)
subdomains = File.readlines("tiny.txt").map(&:chomp)
resolv = Resolv.new(:nameserver => ['8.8.8.8', '8.8.4.4'])
valid_subdomains = subdomains.each_with_object([]) do |subdomain, valid_subdomains|
domains.each do |domain|
combined_name = "#{subdomain}.#{domain}"
puts "Checking #{combined_name}"
ip = resolv.getaddress(combined_name) rescue nil
valid_subdomains << "#{combined_name}#{ip}" if ip
end
end
valid_subdomains.each_slice(4).each do |z|
if z[1] && z[3]
puts "#{z[0]}\t#{z[1]}\t\t#{z[2]}\t#{z[3]}"
end
end
puts "Finished at #{Time.now.strftime("%H:%M:%S")}"
end
此外,您可能想要查看dnsruby gem( https://github.com/alexdalitz/dnsruby )。 它可能會比Resolv做得更好。
[注意:我已經重寫了代碼,以便以塊的形式獲取IP地址。 請參閱https://gist.github.com/keithrbennett/3cf0be2a1100a46314f662aea9b368ed 。 您可以修改RESOLVE_CHUNK_SIZE常量以平衡性能和資源負載。]
我使用dnsruby gem重寫了這段代碼(主要由Alex Dalitz在英國編寫,並由我和其他人貢獻)。 此版本使用異步消息處理,以便幾乎同時處理所有請求。 我在https://gist.github.com/keithrbennett/3cf0be2a1100a46314f662aea9b368ed上發布了一個要點,但也會在這里發布代碼。
請注意,由於您不熟悉Ruby,因此代碼中有許多內容可能對您有所幫助,例如方法組織,使用Enumerable方法(例如驚人的“分區”方法),Struct類,拯救特定的異常類,%w和Benchmark。
注意:看起來像堆棧溢出執行最大消息大小,因此該代碼被截斷。 轉到上面鏈接的完整代碼的GIST。
#!/usr/bin/env ruby
# Takes a list of subdomain prefixes (e.g. %w(ftp xyz)) and a list of domains (e.g. %w(nytimes.com afp.com)),
# creates the subdomains combining them, fetches their IP addresses (or nil if not found).
require 'dnsruby'
require 'awesome_print'
RESOLVER = Dnsruby::Resolver.new(:nameserver => %w(8.8.8.8 8.8.4.4))
# Experiment with this to get fast throughput but not overload the dnsruby async mechanism:
RESOLVE_CHUNK_SIZE = 50
IpEntry = Struct.new(:name, :ip) do
def to_s
"#{name}: #{ip ? ip : '(nil)'}"
end
end
def assemble_subdomains(subdomain_prefixes, domains)
domains.each_with_object([]) do |domain, subdomains|
subdomain_prefixes.each do |prefix|
subdomains << "#{prefix}.#{domain}"
end
end
end
def create_query_message(name)
Dnsruby::Message.new(name, 'A')
end
def parse_response_for_address(response)
begin
a_answer = response.answer.detect { |a| a.type == 'A' }
a_answer ? a_answer.rdata.to_s : nil
rescue Dnsruby::NXDomain
return nil
end
end
def get_ip_entries(names)
queue = Queue.new
names.each do |name|
query_message = create_query_message(name)
RESOLVER.send_async(query_message, queue, name)
end
# Note: although map is used here, the record in the output array will not necessarily correspond
# to the record in the input array, since the order of the messages returned is not guaranteed.
# This is indicated by the lack of block variable specified (normally w/map you would use the element).
# That should not matter to us though.
names.map do
_id, result, error = queue.pop
name = _id
case error
when Dnsruby::NXDomain
IpEntry.new(name, nil)
when NilClass
ip = parse_response_for_address(result)
IpEntry.new(name, ip)
else
raise error
end
end
end
def main
# domains = File.readlines("domains.txt").map(&:chomp)
domains = %w(nytimes.com afp.com cnn.com bbc.com)
# subdomain_prefixes = File.readlines("subdomain_prefixes.txt").map(&:chomp)
subdomain_prefixes = %w(www xyz)
subdomains = assemble_subdomains(subdomain_prefixes, domains)
start_time = Time.now
ip_entries = subdomains.each_slice(RESOLVE_CHUNK_SIZE).each_with_object([]) do |ip_entries_chunk, results|
results.concat get_ip_entries(ip_entries_chunk)
end
duration = Time.now - start_time
found, not_found = ip_entries.partition { |entry| entry.ip }
puts "\nFound:\n\n"; puts found.map(&:to_s); puts "\n\n"
puts "Not Found:\n\n"; puts not_found.map(&:to_s); puts "\n\n"
stats = {
duration: duration,
domain_count: ip_entries.size,
found_count: found.size,
not_found_count: not_found.size,
}
ap stats
end
main
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.