Nmap dns-cache-snoop NSE Script
This page contains detailed information about how to use the dns-cache-snoop NSE script. For list of all NSE scripts, visit the Nmap NSE Library.
Select: |
---|
Script Overview
Script source code: https://github.com/nmap/nmap/tree/master/scripts/dns-cache-snoop.nse
Script categories: intrusive, discovery
Target service / protocol: dns, udp
Target network port(s): 53
List of CVEs: -
Script Description
The dns-cache-snoop.nse script performs DNS cache snooping against a DNS server.
There are two modes of operation, controlled by the
dns-cache-snoop.mode
script argument. In
nonrecursive
mode (the default), queries are sent to the
server with the RD (recursion desired) flag set to 0. The server should
respond positively to these only if it has the domain cached. In
timed
mode, the mean and standard deviation response times
for a cached domain are calculated by sampling the resolution of a name
(www.google.com) several times. Then, each domain is resolved and the
time taken compared to the mean. If it is less than one standard
deviation over the mean, it is considered cached. The timed
mode inserts entries in the cache and can only be used reliably once.
The default list of domains to check consists of the top 50 most popular
sites, each site being listed twice, once with "www." and once without.
Use the dns-cache-snoop.domains
script argument to use a
different list.
Dns-cache-snoop NSE Script Arguments
This is a full list of arguments supported by the dns-cache-snoop.nse script:
dns-cache-snoop.domainsAn array of domain to check in place of the default list.
dns-cache-snoop.mode
Which of two supported snooping methods to use. nonrecursive
, the default, checks if the server returns results for non-recursive queries. Some servers may disable this. timed
measures the difference in time taken to resolve cached and non-cached hosts. This mode will pollute the DNS cache and can only be used once reliably.
- - -
To use these script arguments, add them to the Nmap command line using the --script-args arg1=value,[arg2=value,..]
syntax. For example:
nmap --script=dns-cache-snoop --script-args dns-cache-snoop.domains=value,dns-cache-snoop.mode=value <target>
Dns-cache-snoop NSE Script Example Usage
Here's an example of how to use the dns-cache-snoop.nse script:
nmap -sU -p 53 --script dns-cache-snoop.nse --script-args 'dns-cache-snoop.mode=timed,dns-cache-snoop.domains={host1,host2,host3}' <target>
Dns-cache-snoop NSE Script Example Output
Here's a sample output from the dns-cache-snoop.nse script:
PORT STATE SERVICE REASON
53/udp open domain udp-response
| dns-cache-snoop: 10 of 100 tested domains are cached.
| www.google.com
| facebook.com
| www.facebook.com
| www.youtube.com
| yahoo.com
| twitter.com
| www.twitter.com
| www.google.com.hk
| www.google.co.uk
|_www.linkedin.com
Dns-cache-snoop NSE Script Example XML Output
There is no sample XML output for this module. However, by providing the -oX <file>
option, Nmap will produce a XML output and save it in the file.xml
file.
Author
- Eugene V. Alexeev
References
- https://nmap.org/nsedoc/scripts/dns-cache-snoop.html
- https://github.com/nmap/nmap/tree/master/scripts/dns-cache-snoop.nse
- http://s3.amazonaws.com/alexa-static/top-1m.csv.zip
See Also
Related NSE scripts to the dns-cache-snoop.nse script:
- dns-blacklist.nse
- dns-brute.nse
- dns-check-zone.nse
- dns-client-subnet-scan.nse
- dns-fuzz.nse
- dns-ip6-arpa-scan.nse
- dns-nsec3-enum.nse
- dns-nsec-enum.nse
- dns-nsid.nse
- dns-random-srcport.nse
- dns-random-txid.nse
- dns-recursion.nse
- dns-service-discovery.nse
- dns-srv-enum.nse
- dns-update.nse
- dns-zeustracker.nse
- dns-zone-transfer.nse
Visit Nmap NSE Library for more scripts.
The dns-cache-snoop.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.
Error: "%s" is not a known mode. Use "nonrecursive" or "timed".
Here is a relevant code snippet related to the "Error: "%s" is not a known mode. Use "nonrecursive" or "timed"." error message:
220: if mode == "nonrecursive" then
221: cached = nonrecursive_mode(host, port, domains)
222: elseif mode == "timed" then
223: cached = timed_mode(host, port, domains)
224: else
225: return string.format("Error: "%s" is not a known mode. Use "nonrecursive" or "timed".")
226: end
227:
228: if #cached > 0 then
229: nmap.set_port_state(host, port, "open")
230: end
Version
This page has been created based on Nmap version 7.92.
Go back to menu.