Skip to content

About

Interesting Networking Stuff

Topics

asnbgpdnsfacebook-downianaicannnetworkingriperoot-serverstld

Resources

Readme
MIT license
Activity

Stars

1 star

Watchers

1 watching

Forks

1 fork
Report repository
BranchesTags

Latest commit

 

History

11 Commits

Folders and files

NameName
Last commit message
Last commit date
img
img
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 

Repository files navigation

BGP-ASN-DNS

This repository includes and summraise some resources in networking

DNS & IPs

Important Resources

Resource Link
Root Servers Map https://root-servers.org/
Root Servers List https://www.iana.org/domains/root/servers
List of All TLD Domains https://www.iana.org/domains/root/db
TLDs (plain text) https://data.iana.org/TLD/tlds-alpha-by-domain.txt
IPv4 Multicast Address Space Registry https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml
IPv4 Special-Purpose Address Registry https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
Autonomous System (AS) Numbers & Registrar https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
Special-Purpose Autonomous System (AS) Numbers https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml
A root server metrics https://a.root-servers.org/metrics

Root Servers

Dig Command

  • dig +trace google.com

  • dig +norecurse google.com

  • dig google.com @a.root-servers.net

  • dig +all +answer +multiline google.com any

  • dig google.com any

  • dig @ns.example.com -tAXFR example.com

  • dig -t <NS,AA,AAAA,TXT> @8.8.8.8 google.com

  • Enumerate all common record types for a domain (ANY queries are largely deprecated per RFC 8482, so loop instead):

    for t in A AAAA NS MX TXT SOA CNAME SRV CAA PTR DNSKEY DS NSEC NSEC3 TLSA SSHFP NAPTR; do
  dig +noall +answer +nocmd example.com $t
done

  • DNS Flags:

RDAP (Structured WHOIS)

JSON replacement for port-43 WHOIS (RFC 7483). Unlike WHOIS it returns a redacted array naming exactly which fields were withheld and how, instead of silent blanks.

Command What it does
curl -s -L https://rdap.org/domain/example.com One-shot lookup; redirector resolves the registry for you
curl -s https://rdap.verisign.com/com/v1/domain/example.com .com/.net registry — thin, names the registrar only
curl -s https://rdap.publicinterestregistry.org/rdap/domain/example.org .org registry
curl -s https://pubapi.registry.google/rdap/domain/example.app .app/.dev/.page registry (Google)
curl -s https://rdap.identitydigital.services/rdap/domain/example.io .io registry — absent from the IANA bootstrap
curl -s https://rdap.cloudflare.com/rdap/v1/domain/example.com Registrar record — carries the contact block registries omit
curl -s https://rdap.namecheap.com/domain/example.com Registrar record (Namecheap)
curl -s https://rdap.iana.org/domain/example.com IANA RDAP

  • Find the RDAP server for any TLD (RFC 7484):

    curl -s https://data.iana.org/rdap/dns.json | jq -r '.services[] | select(.[0]|index("org")) | .[1][]'

    The bootstrap is gTLD-focused — .io, .sh, .ac, .de are absent (.uk is one of the few ccTLDs present). Query the operating registry directly for the rest.

  • Key fields in the JSON: redacted[] (what was withheld + method), entities[].roles = registrant/registrar with a vcardArray contact block, and events[] (registration / expiration / last changed). Pipe to jq or python3 -m json.tool to read it.

  • Addresses are jCard (RFC 7095) — 7 fixed slots that registries redact individually:

    ["adr", {"cc":"XX"}, "text", ["pobox", "ext", "street", "city", "region", "postcode", "country"]]
                                 0       1       2        3        4          5          6

    Slot 3 (city) is commonly blanked while slot 4 (region) and the cc param are published — a real location often survives there even on a "redacted" record.

  • Gotchas:

    • A registrant whose phone/address matches the registrar's own is a privacy proxy, not the owner (Cloudflare, Withheld for Privacy ehf, etc.).
    • Registry and registrar records differ — check both before concluding a field is hidden.
    • Endpoints rate-limit; save to a file rather than re-querying.
    • A records behind a CDN are anycast and say nothing about the registrant.

Unmasking a Masked Registrant

Privacy/proxy protection masks the registrant record only — not the owner's operational footprint (mail, certs, analytics, archives, code). Passive OSINT below is for domains you own or are authorized to assess.

  • Shared-infrastructure pivot — highest yield: correlate one operator across sites.

    # analytics / ad IDs reused across a network -> then reverse them (builtwith, dnslytics, spyonweb)
curl -s https://example.com | grep -oE 'G-[A-Z0-9]+|GT-[A-Z0-9]+|UA-[0-9]+-[0-9]+|ca-pub-[0-9]+'
# favicon hash -> Shodan http.favicon.hash:<v> / Censys favicons.md5_hash
curl -s https://example.com/favicon.ico | python3 -c "import sys,mmh3,base64;print(mmh3.hash(base64.encodebytes(sys.stdin.buffer.read())))"

  • Certificate Transparency — every cert ever issued: subdomains + the cert O= org.

    curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u  # subdomains
# crt.sh 502s often — retry, or use censys / https://ui.ctsearch.entrust.com
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -ext subjectAltName   # O=, OU=, emailAddress=, sister domains in SAN

  • Origin IP behind a CDN/WAF — mail and old DNS usually aren't proxied; origin IP -> reverse-IP -> other domains.

    dig +short MX example.com                                   # mail often on the real origin
dig +short A mail.example.com cpanel.example.com direct.example.com webmail.example.com
dig +short TXT example.com                                  # SPF ip4:/include: can name the host
# historical A (pre-CDN): securitytrails, censys, virustotal, https://viewdns.info/iphistory/
# reverse-IP -> co-hosted sites: viewdns.info/reverseip , hackertarget.com

  • Email & DNS metadata

    dig +short SOA example.com | awk '{print $2}'   # RNAME = admin email (first dot -> @)
dig +short TXT _dmarc.example.com               # rua=/ruf= mailto: -> monitored contact
for s in google default selector1 selector2 k1 dkim mail; do dig +short TXT $s._domainkey.example.com; done
curl -s https://example.com/.well-known/security.txt

  • Historical & archived records — privacy is often added after registration; the old record/site stays public.

    curl -s 'https://web.archive.org/cdx/search/cdx?url=example.com&output=json&collapse=digest&fl=timestamp,original,statuscode'
# -> https://web.archive.org/web/<timestamp>/http://example.com/contact
# historical & reverse WHOIS: viewdns.info/whoishistory , viewdns.info/reversewhois , whoxy.com , securitytrails

  • Content & document metadata

    curl -s https://example.com | grep -oiE 'mailto:[^"]+|tel:[^"]+|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}'
exiftool file.pdf          # Author / Creator / Company / GPS baked into published files
curl -s https://example.com/.git/config    # leaked repo -> committer name/email

  • Identity pivot — one email/handle mapped across the internet: holehe target@email.com, maigret <user> (or sherlock).

  • Frameworks — theHarvester -d example.com -b all, amass enum -passive -d example.com, recon-ng, spiderfoot. Hosted: builtwith, dnslytics, securitytrails, shodan, censys.

  • Out of scope — social-engineering the registrar/privacy provider, legal-process data, breach dumps used to dox a private individual, or any host intrusion. Authorized targets only.

Useful Websites

Tool Purpose Link
whatsmydns Global DNS propagation checker https://www.whatsmydns.net/#A/google.com
DNSViz DNSSEC chain-of-trust visualizer https://dnsviz.net/
Zonemaster Full zone health check https://zonemaster.net/
intoDNS Quick zone diagnostics https://intodns.com/
DNS Checker Global propagation checker https://dnschecker.org/
Root zone file Full authoritative root zone https://www.internic.net/domain/root.zone
ICANN CZDS Download TLD zone files https://czds.icann.org/
Farsight DNSDB Passive DNS history https://www.farsightsecurity.com/solutions/dnsdb/

Public Resolvers

Provider IPv4 Notes
Cloudflare 1.1.1.1, 1.0.0.1 DoH: https://cloudflare-dns.com/dns-query
Google 8.8.8.8, 8.8.4.4 —
Quad9 9.9.9.9 Blocks malicious domains
AdGuard 94.140.14.14 Blocks ads
DNS0.eu 193.110.81.0 EU-based, privacy-focused

Modern Dig Alternatives

Tool Notes Link
drill Part of ldns, dig replacement —
kdig Knot DNS, supports DoH/DoT/DoQ —
dog Colorful modern CLI https://github.com/ogham/dog
doggo Go-based, JSON output https://github.com/mr-karan/doggo

ASN

Important Resources

Resource Purpose Link
Hurricane Electric BGP ASN info, graph, connected ASNs, prefixes https://bgp.he.net/AS8697
bgp.tools Cleaner UI, leak/hijack detection https://bgp.tools/
PeeringDB Interconnection & facility database https://www.peeringdb.com/
nitefood/asn CLI tool for ASN/IP/BGP lookups https://github.com/nitefood/asn

Team Cymru IP-to-ASN whois (one-shot CLI):

whois -h whois.cymru.com " -v 8.8.8.8"

BGP & BGPlay

RIPE API

Full documentation cen be found in https://stat.ripe.net/docs/02.data-api/ (Very Interesting!)

  • Get Country ASN List 
    https://stat.ripe.net/data/country-asns/data.json?resource=jo&lod=1
  • Get IP/Domain Info for DNS/IP 
    curl --location --request GET "https://stat.ripe.net/data/dns-chain/data.json?resource=94.249.58.131"

FB Goes Down!

You can observe how FB went down on October 4, 2021 at 15:00 by extracting their NS server, extracting the ASN, and inserting it into the RIPE BGPlay.

BGPlay

Live BGP Data Sources

Source Purpose Link
RIPE RIS Live Real-time BGP updates via WebSocket https://ris-live.ripe.net/
RouteViews Historical MRT archive http://routeviews.org/
CAIDA BGPStream Programmatic BGP analysis (Py/C) https://bgpstream.caida.org/
Cloudflare Radar Traffic, routing, outages https://radar.cloudflare.com/
IODA Internet outage detection https://ioda.inetintel.cc.gatech.edu/
GRIP BGP hijack alert feed https://grip.inetintel.cc.gatech.edu/

RPKI (Route Origin Validation)

Resource Purpose Link
Cloudflare RPKI portal Status & diagnostics https://rpki.cloudflare.com/
isBGPSafeYet RPKI deployment tracker https://isbgpsafeyet.com/
Routinator NLnet Labs RPKI validator https://routinator.docs.nlnetlabs.nl/
Krill NLnet Labs RPKI CA https://krill.docs.nlnetlabs.nl/

Famous BGP Incidents

Year Incident What happened
1997 AS7007 leak First global BGP meltdown — AS7007 re-advertised full table as /24s
2008 YouTube hijack Pakistan Telecom /24 more-specific leaked worldwide
2018 Google via China Telecom Google traffic rerouted through China Telecom
2018 MainOne leak Leaked Google prefixes via China Telecom
2020 Rostelecom leak 8800+ prefixes leaked in April 2020
2021 Facebook outage Oct 4 — BGP withdrawal took FB/IG/WA offline (see BGPlay above)
2022 KlaySwap hijack Feb — DNS + BGP attack, crypto theft
2022 Twitter via RTCOMM March — BGP leak by Rostelecom subsidiary

Measurement & Labs

Tool Purpose Link
RIPE Atlas Global probe network + measurement API https://atlas.ripe.net/
M-Lab Speed/latency measurement data https://www.measurementlab.net/
Containerlab BGP labs with FRR/BIRD/SR Linux https://containerlab.dev/
mtr Traceroute + ping combined —
scamper Active Internet measurement (CAIDA) https://www.caida.org/catalog/software/scamper/

Buy me a Coffee:

BTC: bc1q2kqvggm552h0csyr0awa2zepdapxdqnacw0z5w

BTC

About

Interesting Networking Stuff

Topics

asnbgpdnsfacebook-downianaicannnetworkingriperoot-serverstld

Resources

Readme
MIT license
Activity

Stars

1 star

Watchers

1 watching

Forks

1 fork
Report repository

Contributors