Disclaimer - This code was written for educational purposes. Although it could be used to scan the entire IP range, this should be avoided. Most hosts have a TOS that prevents this kind of thing. People who scan globally suck, so don't be that person.
TO-DO:
-Add other common methods (SSDP, NTP) to work in a single scanner
Note I have tested the spoofed scanning and it works
dns_listen must be run with sudo priviledes
Scanning is often done to find DNS resolvers which readily respond to queries, so that they can be used in DNS Amplification Attacks (DDOS).
As noted earlier most hosts won't let you scan. People who want to DDOS need to use servers that can spoof ip headers (usually expensive). If a person DDOSing has a host that doesn't ban them for modifying the IP header and they ignore the insane amounts of traffic as well, then this server could also be used to scan lists with spoofing. This allows the person the ability to spoof the IP of a cheap vps server they own which will act like the listener and filter, while the spoof server is the scanner. Let spoofable server = S, cheap 5$ vps = L, some dns resolver = D
- L starts running dns_listen
- S starts scanning IP range, sets source address = [VPS IP]
- S sends D a query with [VPS IP]
- D sends response to L
- L filters and stores lists
The benefit of this, is obscurity. No new traffic is leaving the spoofed server, so there is no new reason for your host to ban you. As far as the other VPS provider knows, your cheap filter server didn't create those packets (could block responses if router filters) and you aren't the responsible party. win-win.
EDNS is Extended DNS. The significance of this is previously DNS had a limit of 512 bytes per packet. EDNS modified this allowing users to include information about the size of packets they can handle. This in and of itself made DNS amplification attacks feasible.
./dns_scan -h 8.8.8.8
Host was specified: 8.8.8.8
Using default domain
Sending: 29 bytes
66 34 01 00 00 01 00 00
00 00 00 01 00 00 FF 00
01 00 00 29 FF FF 00 00
00 00 00 00 00
sudo ./dns_list
Server: 8.8.8.8 Responded with: 2043 bytes with 5376 records