hazcod / dnstwist

A tool to monitor for potential spear phishing domains and send to Slack.

dnstwist

This is a tool that will fetch potential typo-squatting or IDN domains which could be targeting your domain for spear phishing. Permutations will be fetched from https://dnstwist.it/.

It will take into account the registration and/or last updated WHOIS information and a potential whitelist.

Domains identified can be sent to Slack for automated alert purposes.

Usage

First create a configuration file:

# log settings, optional
log:
  # log level to use
  level: info

# the domains you'd like to monitor, required
domains:
  # domain(s) to monitor
  watchlist: [domain.com]
  # any domains to ignore
  whitelist: []
  # domains created in the last week
  created_since: 168h

# send alerts to a Slack channel, optional
slack:
  # slack channel webhook
  webhook: https://hooks.slack.com/services/XXX

And then run the tool:

% dnstwist -config=config.yml

You can also set configuration values via environment variables:

% LOG_LEVEL=info DOMAIN_WATCHLIST=domain.com SLACK_WEBHOOK=xxx dnstwist

And use it with the Docker image!

% docker run -ti --rm -e "DOMAIN_WATCHLIST=domain.com" -e "SLACK_WEBHOOK=xxx" ghcr.io/hazcod/dnstwist/dnstwist:latest

dnstwist's Issues

Replace with appropriate checks (e.g. spell checking).

Line: 27
https://github.com/hazcod/dnstwist/blob/ca08a6c82b6bf8f8391b73cf19b38eed734f32b5//.git/hooks/sendemail-validate.sample#L24-L34

Replace with appropriate checks for this patch

(e.g. checkpatch.pl).

Line: 35
https://github.com/hazcod/dnstwist/blob/ca08a6c82b6bf8f8391b73cf19b38eed734f32b5//.git/hooks/sendemail-validate.sample#L32-L42

replace dnstwist by our own permutation engine

Line: 38

dnstwist//pkg/dnstwist/request.go

Lines 35 to 45 in 380955a

	URL string `json:"url"`
	}
	// TODO: replace dnstwist by our own permutation engine
	func Request(ctx context.Context, l *logrus.Logger, domain string) (*Twister, error) {
	if domain == "" || !strings.Contains(domain, ".") {
	return nil, fmt.Errorf("invalid domain: %s", domain)
	}
	logger := l.WithField("domain", domain)

Replace with appropriate checks for the whole series

(e.g. quick build, coding style checks, etc.).

Line: 41
https://github.com/hazcod/dnstwist/blob/ca08a6c82b6bf8f8391b73cf19b38eed734f32b5//.git/hooks/sendemail-validate.sample#L38-L48