Bug Bounty Diary

-----‐------------------------------- ✎ Discovering Domains via NS Correlation -----‐------------------------------- ● What is a Nameserver? A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server. In this post I will describe a simple technique which can be used to correlate one or more websites using NS data. ● Finding Nameservers To find the nameservers for a domain name, the simplest way is to use the dig tool:

$ dig +noall +answer ns deliveroo.com
deliveroo.com.          86400   IN      NS      mona.ns.cloudflare.com.
deliveroo.com.          86400   IN      NS      phil.ns.cloudflare.com.

● Finding Related Domains Some DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair. In the example above, deliveroo.com uses the Cloudflare nameserver pair mona.ns.cloudflare.com and phil.ns.cloudflare.com. Domains added under the same Cloudflare account are often assigned the same NS pair. Since the number of possible Cloudflare NS pair combinations is limited, many domains share them, making it relatively easy to identify other domains that may be managed by the same operator. ● Downloading The Dataset Merklemap provides a DNS record database containing 4 billion+ records. You can download it here. The dataset is provided in JSONL format and is compressed using xz. The uncompressed raw data is around ~500GB in size. If you just want to extract domain/NS pairs in the format domain,ns1,ns2,ns... you can use xzcat with jq like so:

xzcat dns_records_database.jsonl.xz | jq -r '
  select([.results[] | .success?.records?.NS? // empty] | length > 0) |
  [.hostname] + [.results[].success?.records?.NS? // empty | .[]] |
  join(",")
' > domains.csv

● Querying the Dataset One way to query the parsed data is using DuckDB. grep will also work but will probably be a bit slower.

NS1="phil.ns.cloudflare.com."
NS2="mona.ns.cloudflare.com."
duckdb -csv -noheader -c "
  SELECT column0 AS domain, column1 AS ns
  FROM read_csv('domains.csv', header=false)
  WHERE list_sort(str_split(column1, ',')) = list_sort(['${NS1}','${NS2}'])
" > results.csv

Looking at results.csv we have ~300 entries. A lot are false positives, but there are some new domains which definitely belong to the same operator:

$ grep -i deliveroo results.csv | cut -d, -f1
deliveroo.de
deliveroo.blog
deliveroo.xn--9dbq2a
... 32 more

In a lot of cases you might not be able to correlate one website to another based on just a keyword in the domain name. In those cases you can do things like: • Fingerprint HTTP responses • Compare WHOIS information • Compare technologies used • DNS similarities #bugbounty #recon #DNS © T.me/BugBounty_Diary