chennqqi / godnslog Goto Github PK

View Code? Open in Web Editor NEW

469.0 9.0 75.0 853 KB

An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability

Home Page: https://www.godnslog.com

License: Apache License 2.0

Dockerfile 0.23% Go 52.17% JavaScript 3.29% Vue 42.26% Less 2.05%

dnslog xss ssrf rce xxe rfi webscan vulnerability

godnslog's Introduction

GODNSLOG

A dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability

English Doc | 中文文档

features

Standard Domain Resolve Service
DNSLOG
HTTPLOG
Rebinding/CustomRebinding
Push (callback)
Multi-user
dockerlized
python/golang client sdk
as a standard name resolve service with support A,CNAME,TXT,MX
xip

DNSLOG

super admin user: admin password will be showed in console logs when first run. you can change it by subcommand resetpw

HTTPLOG

build frontend

requirements:

yarn

cd frontend
yarn install
yarn build

build backend

requirements:

golang >= 1.13.0

go build

docker build

docker build -t "user/godnslog" .

For Chinese user:

docker build -t "user/godnslog" -f DockerfileCN .

RUN

i. Register your domain, eg: example.com Set your DNS Server point to your host, eg: ns.example.com => 100.100.100.100 Some registrar limit set to NS host, your can set two ns host point to only one address. Some registrar to ns host must be different ip address, you can set one to a fake addresss and then change to the same addresss

ii. self build

docker run -p80:8080 -p53:53/udp "user/godnslog"  serve -domain yourdomain.com -4 100.100.100.100

or use dockerhub

docker pull "sort/godnslog"
docker run -p80:8080 -p53:53/udp -p80:8080  "sort/godnslog" serve -domain yourdomain.com -4 100.100.100.100

iii. access http://100.100.100.100

Doc

guest/guest123

introduce payload api rebiding resolve

TODO && Known Issues

[ ]~~enhance reverse proxy~~
admin user can read all recordds
allow Anonymous user access document page
enable custom rebinding stage two setting
fix login logical problem

Follow me

godnslog's People

Contributors

Stargazers

Watchers

Forkers

kakakpy coffeehb mr-xn 5l1v3r1 javalangclass aaq1adqwe forkkit laowang1026 shmilylty h1d3r 0xlwoe21k fadinglr samueltt hex0wn atcom1 fdlucifer conanjun r4b3rt vysecurity uchihasr l1kw1d isgasho evi1hack mikesdsd xiaobei97 god-ok kele2016 lovetrap fzpixzj90h7baqieoop5hg w01fb0ss tuuunya r0ck3rt yezi-m4c1 jeromeyoung wivd c00000rpse d1937 grue zzzz0317 jxpsx afwu 1oca1h0st g00000000 pochubs exploit-3389 flyinbedxyz ganshichuangye patrickstarwow leezp rockmelodies qsdj soliontheroad uknowsec fighttigers npmmirror attacker-codeninja wooyun-evil hho2002 kzaopa green-m wang0098 ofalwl navin-hacsociety istoliving aels lay0us1 zoukba0014 c1371064 atomxw angel1374 iq-scm iamblackcat 4ga1n

godnslog's Issues

希望管理员能够查看所有人的记录

主要是团队内部使用可以协同，方便一些

enable reset admin password

enable reset admin password by run app or docker exec

建议提供官方的docker-compose.yml文件

我这里有一份参考：

version: "3.5"

services:
  godnslog:
    image: sort/godnslog
    environment:
      - GIN_MODE=release
    ports:
      - "127.0.0.1:10080:8080"    # 反向代理模式
      - "53:53/udp"
    restart: always
    command: serve -domain yourdomain.com -4 x.x.x.x
    volumes:
      - ./godnslog.db:/app/godnslog.db   # 持久化存储

页面显示的http log地址有问题

这里应该显示容器映射到宿主机的端口，而不是容器中的端口，这样就会导致访问不到。

难用的一笔

我推荐https://github.com/Li4n0/revsuit

请问下回调地址如何填写使用呢

我填写了回调地址后，当页面中收了dns记录后并未向我的回调地址发送任何东西。

dnslog定时清理功能

dnslog定时清理功能可能是为了方便清理，但是遇到延时dnslog就不太方便，现在是2小时自动清理，好像是设置功能更新那里有bug没写好，点击更新服务端502错误。❌

DNS配置好后，无法解析。

按你文档中配置好自定义DNS HOST然后运行程序后，无法收到DNS请求。可以的话加个微信请教一下：o0x1024

重绑定功能另一种实现方法建议

192.168.1.1.127.0.0.1.godnslog.com -> 192.168.1.1，first time
192.168.1.1.127.0.0.1.godnslog.com -> 127.0.0.1，second time
...

同学，您这个项目引入了90个开源组件，存在3个漏洞，辛苦升级一下

检测到 chennqqi/godnslog 一共引入了90个开源组件，存在3个漏洞

漏洞标题：jwt-go 安全漏洞
缺陷组件：github.com/dgrijalva/[email protected]+incompatible
漏洞编号：CVE-2020-26160
漏洞描述：jwt-go是个人开发者的一个Go语言的JWT实现。
jwt-go 4.0.0-preview1之前版本存在安全漏洞。攻击者可利用该漏洞在使用[]string{} for m[\"aud\"](规范允许)的情况下绕过预期的访问限制。
影响范围：(∞, 4.0.0-preview1)
最小修复版本：4.0.0-preview1
缺陷组件引入路径：github.com/chennqqi/godnslog@->github.com/dgrijalva/[email protected]+incompatible

另外还有3个漏洞，详细报告：https://mofeisec.com/jr?p=ad9a2c

Enable user custom subdomain as a standard dns server

Bug: 新建的用户，经常出现无法ping，无法dns解析的问题new users often fail to Ping and DNS resolution

bug：新建的用户，经常出现无法ping，无法dns解析的问题

但是重启docker又正常了
Bug: new users often fail to Ping and DNS resolution

But restarting docker is normal again

生成测试数据：

for (( i=1; i<=100; i=i+1 )); do dig "test${i}.qwerty123456.example.com"; sleep 0.1; done

调用 API 搜索 test，响应无法看到最新数据：

{"message":"OK","code":0,"timestemp":1643031077,"result":[{"domain":"test1.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:33Z"},{"domain":"test2.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test3.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test4.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test5.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test6.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test7.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test8.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test9.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:34Z"},{"domain":"test10.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test11.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test12.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test13.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test14.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test15.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test16.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test17.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:35Z"},{"domain":"test18.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:36Z"},{"domain":"test19.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:36Z"},{"domain":"test20.qwerty123456.example.com","addr":"10.0.0.2","ctime":"2022-01-24T12:52:36Z"}]}

这个 API 目前只能用于针对性地判断特定记录是否存在，无法批量导出数据。

建议：API 响应结果倒序排列；另外建议增加返回结果数量参数，固定 20 条太少了，大批量扫描时容易错过部分记录

注：我使用的是 0.7.0 版本

查询界面功能建议

显示结果的数量
增加导出功能（JSON、CSV 等简单的格式就够用了）

注：我使用的是 0.7.0 版本

Ubuntu
Ubuntu 基础镜像中没有安装了 tzdata 包，因此我们需要先安装 tzdata 包。
我们可以将以下代码添加到 Dockerfile 中。

ENV TZ=Asia/Shanghai \
DEBIAN_FRONTEND=noninteractive

RUN apt update \
&& apt install -y tzdata \
&& ln -fs /usr/share/zoneinfo/${TZ} /etc/localtime \
&& echo ${TZ} > /etc/timezone \
&& dpkg-reconfigure --frontend noninteractive tzdata \
&& rm -rf /var/lib/apt/lists/*

5、查询界面可以给一点友好提醒
看到的ip不是目标的服务器的互联网ip

编译不出来了出错了

一大堆错误编译不通过了拉取docker镜像都不成功了

既然都有http服务了，建议增加个文件下载

测试http连接时，可以直接下载执行就更加美滋滋了，建议增加上，使用起来就更方便了