Rogue one

A PoC tool for analyzing a rogue DNS server.

This tool could be used for checking maliciousness of a DNS server and extracting landing pages.

How it works

IPv4 space is vast. But an attacker could secure a few numbers of IP addresses for landing pages. It means you can (probably) find malicious landing pages by using the following methods.

Resolving a bunch of domains by using a DNS server.
Finding frequent IPv4s from the resolutions. They might be landing pages.
If a DNS server has landing pages, it might be a rogue one.

Requirements

Ruby 3.x / Ruby 2.7+

Installation

gem install rogue_one

Usage

$ rogue_one
Commands:
  rogue_one help [COMMAND]       # Describe available commands or one specific command
  rogue_one report [DNS_SERVER]  # Show a report of a given DNS server

$ rogue_one help report
Usage:
  rogue_one report [DNS_SERVER]

Options:
  [--custom-list=CUSTOM_LIST]    # A path to a custom list of domains
  [--default-list=DEFAULT_LIST]  # A default list of top 100 domains (Alexa or Fortune)
                                 # Default: alexa
  [--record-type=RECORD_TYPE]    # A type of the DNS resource to check
                                 # Default: A
  [--threshold=N]                # Threshold value for determining malicious or not
  [--verbose], [--no-verbose]

Show a report of a given DNS server

$ rogue_one report 1.1.1.1
{
  "verdict": "benign one",
  "landing_pages": [

  ]
}

$ rogue_one report 1.53.252.215
{
  "verdict": "rogue one",
  "landing_pages": [
    "1.171.168.19",
    "1.171.170.228",
    "61.230.102.66"
  ]
}

$ rogue_one report 171.244.3.111 --custom-list tmp/roaming.yml
{
  "verdict": "rogue one",
  "landing_pages": [
    "154.223.53.53",
    "58.82.243.9"
  ]
}
# Note: a custom list should be an array of domains in a YAML file.

Key	Desc.
verdict	A detection result (`rogue one` or `benign one`)
landing_pages	An array of IP of landing pages
results	DNS resolution results (only available if --verbose option is specified)

Notes

This is just a PoC tool. I cannot guarantee the results with high confidence at the moment.

License

The gem is available as open source under the terms of the MIT License.

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

ninoseki / rogue_one