GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → D4-project → analyzer-d4-passivedns

D4-project / analyzer-d4-passivedns

Licence: AGPL-3.0 license
A Passive DNS backend and collector

Programming Languages

python
139335 projects - #7 most used programming language
shell
77523 projects

Labels

dnsnetwork-monitoringnetwork-securitypassive-dnspassive-dns-collectionsecurity-monitoringd4-project

Projects that are alternatives of or similar to analyzer-d4-passivedns

BGP-Ranking
BGP ranking is a free software to calculate the security ranking of Internet Service Provider (ASN)
Stars: ✭ 49 (+88.46%)
Mutual labels:  network-monitoring, network-security, d4-project
d4-core
D4 core software (server and sample sensor client)
Stars: ✭ 40 (+53.85%)
Mutual labels:  network-monitoring, network-security, d4-project
community-id-spec
An open standard for hashing network flows into identifiers, a.k.a "Community IDs".
Stars: ✭ 137 (+426.92%)
Mutual labels:  network-monitoring, network-security
network-tools
Network Tools
Stars: ✭ 27 (+3.85%)
Mutual labels:  network-monitoring, network-security
pycommunityid
A Python implementation of the Community ID flow hashing standard
Stars: ✭ 18 (-30.77%)
Mutual labels:  network-monitoring, network-security
pdns-qof
Passive DNS Common Output Format
Stars: ✭ 30 (+15.38%)
Mutual labels:  network-security, passive-dns
Zeek-Network-Security-Monitor
A Zeek Network Security Monitor tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.
Stars: ✭ 38 (+46.15%)
Mutual labels:  network-monitoring, network-security
testmynids.org
A website and framework for testing NIDS detection
Stars: ✭ 55 (+111.54%)
Mutual labels:  network-monitoring, network-security
Nfstream
NFStream: a Flexible Network Data Analysis Framework.
Stars: ✭ 622 (+2292.31%)
Mutual labels:  network-monitoring, network-security
Zxrequestblock
基于NSURLProtocol一句话实现iOS应用底层所有网络请求拦截(含网页ajax请求拦截【不支持WKWebView】)、一句话实现防抓包(使Thor，Charles，Burp等代理抓包方式全部失效，且即使开启了代理，也不影响App内部的正常请求)。包含http-dns解决方法，有效防止DNS劫持。用于分析http，https请求等
Stars: ✭ 160 (+515.38%)
Mutual labels:  network-monitoring, network-security
masscanned
Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.
Stars: ✭ 50 (+92.31%)
Mutual labels:  network-monitoring, network-security
Hack-Utils
Script to facilitate different functions and checks
Stars: ✭ 27 (+3.85%)
Mutual labels:  network-monitoring, network-security
Ivre
Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!
Stars: ✭ 2,331 (+8865.38%)
Mutual labels:  network-monitoring, network-security
ivre
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!
Stars: ✭ 2,712 (+10330.77%)
Mutual labels:  network-monitoring, network-security
Guppy-iOS
iOS pod about a curious fish named Guppy
Stars: ✭ 42 (+61.54%)
Mutual labels:  network-monitoring
SaltwaterTaffy
An nmap wrapper library for .NET
Stars: ✭ 44 (+69.23%)
Mutual labels:  network-security
RealIP
The Spigot, Bungee and Velocity plugin that parses client IP addresses passed from the TCPShield network.
Stars: ✭ 121 (+365.38%)
Mutual labels:  network-security
flydns
Related subdomains finder
Stars: ✭ 29 (+11.54%)
Mutual labels:  network-security
NetworkAlarm
A tool to monitor local network traffic for possible security vulnerabilities. Warns user against possible nmap scans, Nikto scans, credentials sent in-the-clear, and shellshock attacks. Currently supports live monitoring and network capture (pcap) scanning.
Stars: ✭ 17 (-34.62%)
Mutual labels:  network-monitoring
dstp
🧪 Run common networking tests against any site.
Stars: ✭ 919 (+3434.62%)
Mutual labels:  network-monitoring
View All Similar Projects ➔

analyzer-d4-passivedns

analyzer-d4-passivedns is an analyzer for a D4 network sensor including a complete Passive DNS server. The analyser can process data produced by D4 sensors (in passivedns CSV format (more to come)) or independently from D4 using COF websocket streams.

The package include a Passive DNS server which can be queried later to search for the Passive DNS records.

Features

Overview

Requirements

  • Python 3.8
  • Redis >5.0 or kvrocks
  • Tornado
  • iptools

Install

Redis

./install_server.sh

All the Python 3 code will be installed in a virtualenv (PDNSENV).

Kvrocks

./install_server_kvrocks.sh

All the Python 3 code will be installed in a virtualenv (PDNSENV).

Running

Start the redis server or kvrocks server

Don't forget to set the DB directory in the redis.conf configuration. By default, the redis for Passive DNS is running on TCP port 6400

./redis/src/redis-server ./etc/redis.conf

or

./kvrocks/src/kvrocks -c ./etc/kvrocks.conf

Start the Passive DNS COF server

. ./PDNSENV/bin/activate
cd ./bin/
python3 ./pdns-cof-server.py

Feeding the Passive DNS server

You have two ways to feed the Passive DNS server. You can combine multiple streams. A sample public COF stream is available from CIRCL with the newly seen IPv6 addresses and DNS records.

(via COF websocket stream) start the importer

python3 pdns-import-cof.py --websocket ws://crh.circl.lu:8888

(via D4) Configure and start the D4 analyzer

cd ./etc
cp analyzer.conf.sample analyzer.conf

Edit the analyzer.conf to match the UUID of the analyzer queue from your D4 server.

[global]
my-uuid = 6072e072-bfaa-4395-9bb1-cdb3b470d715
d4-server = 127.0.0.1:6380
# INFO|DEBUG
logging-level = INFO

then you can start the analyzer which will fetch the data from the analyzer, parse it and populate the Passive DNS database.

. ./PDNSENV/bin/activate/
cd ./bin/
python3 pdns-ingestion.py

Usage

Querying the server

adulau@kolmogorov ~/git/analyzer-d4-passivedns (master)$ curl -s http://127.0.0.1:8400/query/xn--ihuvudetpevap-xfb.se | jq .
{
  "time_first": 1657878272,
  "time_last": 1657878272,
  "count": 1,
  "rrtype": "AAAA",
  "rrname": "xn--ihuvudetpevap-xfb.se",
  "rdata": "2a02:250:0:8::53",
  "origin": "origin not configured"
}
curl -s http://127.0.0.1:8400/query/2a02:250:0:8::53 
{"time_first": 1657878141, "time_last": 1657878141, "count": 1, "rrtype": "AAAA", "rrname": "media.vastporten.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878929, "time_last": 1657878929, "count": 1, "rrtype": "AAAA", "rrname": "www.folkinitiativetarjeplog.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878272, "time_last": 1657878272, "count": 1, "rrtype": "AAAA", "rrname": "xn--ihuvudetpevap-xfb.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878189, "time_last": 1657878189, "count": 1, "rrtype": "AAAA", "rrname": "media.primesteps.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878986, "time_last": 1657878986, "count": 1, "rrtype": "AAAA", "rrname": "media.skellefteaadventurepark.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874940, "time_last": 1657874940, "count": 1, "rrtype": "AAAA", "rrname": "galleri.torsaspaintball.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874205, "time_last": 1657874205, "count": 1, "rrtype": "AAAA", "rrname": "www.media1.harlaut.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878165, "time_last": 1657878165, "count": 1, "rrtype": "AAAA", "rrname": "www.sd-nekretnine.rs", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878678, "time_last": 1657878678, "count": 1, "rrtype": "AAAA", "rrname": "www.www2.resultat-balans.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874288, "time_last": 1657874288, "count": 1, "rrtype": "AAAA", "rrname": "www.assistanshemtjanst.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878943, "time_last": 1657878943, "count": 1, "rrtype": "AAAA", "rrname": "kafekultur.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878141, "time_last": 1657878141, "count": 1, "rrtype": "AAAA", "rrname": "media1.rlab.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878997, "time_last": 1657878997, "count": 1, "rrtype": "AAAA", "rrname": "serbiagreenbuildingexpo.com", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657879064, "time_last": 1657879064, "count": 1, "rrtype": "AAAA", "rrname": "www.framtro.nu", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874285, "time_last": 1657874285, "count": 1, "rrtype": "AAAA", "rrname": "www.twotheartist.com", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878774, "time_last": 1657878774, "count": 1, "rrtype": "AAAA", "rrname": "media.narkesten.se", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}

License

The software is free software/open source released under the GNU Affero General Public License version 3.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].