Merge pull request #691 from blacklanternsecurity/dev

Dev->Main

Author: liquidsec

.github/workflows/read-sources.yml

@@ -13,7 +13,9 @@ jobs:
   readsources:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+      with:
+        ref: dev
 
     - name: Set up Python
       uses: actions/setup-python@v4
@@ -118,10 +120,6 @@ jobs:
                 continue
             fi
 
-            # Add the new hash to the history file
-            echo "adding hash $new_hash to signature file" >> readsources_action.log
-            echo "$new_hash #$file" >> "baddns/signatures/signature_history.txt"
-
             # Copy the file to the signatures directory
             cp "signatures_to_test/$file" "baddns/signatures/$file"
 
@@ -167,13 +165,12 @@ jobs:
             echo "checking out new branch $BRANCH_NAME" >> readsources_action.log
             git checkout -b $BRANCH_NAME
             git add "baddns/signatures/$file"
-            git add "baddns/signatures/signature_history.txt"
             echo "about to commit with the following files changed:" >> readsources_action.log
             git status -s >> readsources_action.log
 
             echo "adding commit and pushing branch..." >> readsources_action.log
             # If the commit operation is successful, then push the changes and create a PR
-            git commit -m "[SignatureBot] Add or update signature $file and update signature history" && {
+            git commit -m "[SignatureBot] Add or update signature $file" && {
               git push origin new-signature-$file
               echo "## Add or update signature: $file" > pr_message
               echo "This PR adds or updates the follow signature:" >> pr_message
@@ -183,13 +180,14 @@ jobs:
               echo '```' >> pr_message
               echo "creating PR: '[SignatureBot] Add or update signature $file'" >> readsources_action.log
               sleep 5
-              gh pr create --title "[SignatureBot] Add or update signature $file" --body-file pr_message --head new-signature-$file --repo ${{ github.repository }} 2>&1 | tee -a readsources_action.log
+              gh pr create --base dev --title "[SignatureBot] Add or update signature $file" --body-file pr_message --head new-signature-$file --repo ${{ github.repository }} 2>&1 | tee -a readsources_action.log
             }
-            git checkout main
+            git checkout dev
           else
             echo "Skipping signature file: $file - no changes detected" >> readsources_action.log
           fi
         done
+
         echo "completed read sources" >> readsources_action.log
 
 

.github/workflows/signature-history.yml

@@ -0,0 +1,53 @@
+name: Update Signature History
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [dev]
+
+permissions:
+  contents: write
+
+jobs:
+  update-history:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, '[SignatureBot]')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: dev
+
+      - name: Update signature history
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+          # Get signature files changed in the merged PR
+          CHANGED_FILES=$(gh pr diff ${{ github.event.pull_request.number }} --name-only | grep '^baddns/signatures/.*\.yml$' || true)
+
+          if [[ -z "$CHANGED_FILES" ]]; then
+            echo "No signature files changed in this PR"
+            exit 0
+          fi
+
+          for file in $CHANGED_FILES; do
+            if [[ -f "$file" ]]; then
+              filename=$(basename "$file")
+              hash=$(sha256sum "$file" | cut -d ' ' -f 1)
+
+              if ! grep -q "$hash" baddns/signatures/signature_history.txt 2>/dev/null; then
+                echo "$hash #$filename" >> baddns/signatures/signature_history.txt
+                echo "Added hash for $filename"
+              fi
+            fi
+          done
+
+          if git diff --quiet baddns/signatures/signature_history.txt 2>/dev/null; then
+            echo "No new hashes to add"
+          else
+            git add baddns/signatures/signature_history.txt
+            git commit -m "[SignatureBot] Update signature history"
+            git push origin dev
+          fi

.github/workflows/tests.yaml

@@ -19,30 +19,32 @@ jobs:
     if: contains(github.event.pull_request.title, 'SignatureBot') == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: psf/black@stable
-        with:
-          options: "--check"
+      - uses: actions/checkout@v4
       - name: Install Python 3
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
-      - name: Install dependencies
-        run: |
-          pip install flake8
-      - name: flake8
-        run: |
-          flake8 --select F,E722 --ignore F403,F405,F541 --per-file-ignores="*/__init__.py:F401,F403"
-  
+          python-version: "3.10"
+      - name: Install ruff
+        run: pip install ruff
+      - name: ruff format
+        run: ruff format --check .
+      - name: ruff check
+        run: ruff check .
+
   test:
     if: contains(github.event.pull_request.title, 'SignatureBot') == false
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+      fail-fast: false
     steps:
-      - uses: actions/checkout@v3
-      - name: Set up Python
-        uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       - name: Install dependencies
         run: |
           pip install poetry
@@ -67,13 +69,13 @@ jobs:
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.12"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
@@ -96,11 +98,11 @@ jobs:
         run: |
           CURRENT_VERSION="${{ env.VERSION }}"
           LATEST_VERSION="${{ env.LATEST_TAG }}"
-          
+
           # Extract major.minor for comparison
           CURRENT_MAJOR_MINOR=$(echo "$CURRENT_VERSION" | cut -d '.' -f 1-2)
           LATEST_MAJOR_MINOR=$(echo "$LATEST_VERSION" | cut -d '.' -f 1-2)
-          
+
           # Compare versions
           if [ "$CURRENT_MAJOR_MINOR" == "$LATEST_MAJOR_MINOR" ]; then
             echo "VERSION_CHANGE=false" >> $GITHUB_ENV

CLAUDE.md

@@ -0,0 +1,95 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+BadDNS is a Python tool for detecting subdomain takeovers and DNS issues (dangling CNAME/NS/MX records, NSEC walks, zone transfers, HTML reference hijacking, DMARC misconfigurations, MTA-STS issues, wildcard DNS takeovers). It's also used as a BBOT module.
+
+## Common Commands
+
+### Install dependencies
+```bash
+pip install poetry
+poetry install
+```
+
+### Run all tests
+```bash
+poetry run pytest --exitfirst --disable-warnings --log-cli-level=DEBUG
+```
+
+### Run a single test file
+```bash
+poetry run pytest tests/cname_test.py -v
+```
+
+### Run a single test
+```bash
+poetry run pytest tests/cname_test.py::test_cname_function_name -v
+```
+
+### Lint
+```bash
+ruff format --check .
+ruff check .
+```
+
+### Format code
+```bash
+ruff format .
+```
+
+### Run the CLI
+```bash
+poetry run baddns example.com
+poetry run baddns -m CNAME,NS example.com    # specific modules
+poetry run baddns -d example.com              # debug mode
+poetry run baddns --direct example.com        # direct mode (CNAME only)
+```
+
+## Architecture
+
+### Module System
+
+All detection logic lives in `baddns/modules/`. Each module is a class inheriting from `BadDNS_base` (defined in `baddns/base.py`). Modules are auto-discovered and dynamically imported by `baddns/__init__.py` — just drop a new `.py` file in `modules/` and it's available.
+
+The 10 modules: **CNAME** (dangling CNAMEs), **NS** (dangling nameservers), **MX** (dangling mail exchangers), **NSEC** (NSEC walking for subdomain enumeration), **TXT** (hijackable domains in TXT records), **references** (hijackable domains in HTML/headers), **zonetransfer** (AXFR vulnerability), **DMARC** (missing/misconfigured DMARC records), **MTA-STS** (MTA-STS misconfigurations and dangling mta-sts subdomains), **WILDCARD** (wildcard DNS records enabling domain-wide takeover).
+
+### Signature-Driven Detection
+
+Signatures are YAML files in `baddns/signatures/` (~100 files). Each signature defines a service name, detection mode (`http`, `dns_nxdomain`, `dns_nosoa`), identifier patterns (cnames, IPs, nameservers), and HTTP matcher rules. The `Signature` class (`baddns/lib/signature.py`) loads them, and `Matcher` (`baddns/lib/matcher.py`) evaluates HTTP responses against matcher rules.
+
+### Core Libraries (`baddns/lib/`)
+
+- **DNSManager** (`dnsmanager.py`) — async DNS resolution with retry, CNAME chain following, multi-record-type dispatch
+- **HttpManager** (`httpmanager.py`) — fires 4 async HTTP requests per target (http/https × follow/deny redirects)
+- **WhoisManager** (`whoismanager.py`) — async WHOIS lookups, checks domain registration/expiration
+- **DnsWalk** (`dnswalk.py`) — recursive nameserver tracing from root servers, used by NS module
+- **Finding** (`findings.py`) — structured output with confidence levels (CONFIRMED/PROBABLE/POSSIBLE/UNLIKELY)
+
+### Execution Flow
+
+CLI (`baddns/cli.py`) → validates args → loads signatures → instantiates selected modules → calls each module's async `dispatch()` → collects `Finding` objects → outputs JSON.
+
+## Testing
+
+Tests are in `tests/` and heavily mock DNS/HTTP/WHOIS. Key test infrastructure:
+
+- `tests/conftest.py` — shared fixtures (`mock_dispatch_whois`, `cached_suffix_list`, `configure_mock_resolver`)
+- `tests/helpers.py` — `MockResolver`, `MockDNSWalk`, `DnsWalkHarness` for DNS mocking
+- Tests use `pytest-asyncio` for async, `pytest-httpx` for HTTP mocking, `pyfakefs` for filesystem mocking
+
+## Versioning
+
+Version is tracked in **two places** in `pyproject.toml`:
+- `tool.poetry.version` (e.g., `"2.0.0"`)
+- `tool.poetry-dynamic-versioning.format` (e.g., `'2.0.{distance}'`)
+
+Both must be updated together for releases. Publishing to PyPI happens automatically on push to `main` when the major.minor version changes.
+
+## Git Workflow
+
+- `main` branch — stable releases, auto-publishes to PyPI
+- `dev` branch — active development, PRs target here
+- Do not add "Co-Authored-By" lines to commit messages

README.md

@@ -1,7 +1,7 @@
 # BadDNS
 Check subdomains for subdomain takeovers and other DNS tomfoolery
 
-[![Black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 ![License](https://img.shields.io/badge/license-GPLv3-f126ea.svg)
 [![tests](https://github.com/blacklanternsecurity/baddns/actions/workflows/tests.yaml/badge.svg)](https://github.com/blacklanternsecurity/baddns/actions/workflows/tests.yaml)
 [![codecov](https://codecov.io/gh/blacklanternsecurity/baddns/branch/main/graph/badge.svg)](https://codecov.io/gh/blacklanternsecurity/baddns)
@@ -24,7 +24,7 @@ Or use pipx: `pipx install git+https://github.com/blacklanternsecurity/baddns`
 After installing with pip, you can just run `baddns` from the command line.
 
 ```
-usage: baddns [-h] [-n CUSTOM_NAMESERVERS] [-c CUSTOM_SIGNATURES] [-l] [-s] [-m MODULES] [-d] [target]
+usage: baddns [-h] [-n CUSTOM_NAMESERVERS] [-c CUSTOM_SIGNATURES] [-l] [-s] [-m MODULES] [-d] [-D] [target]
 
 Check subdomains for subdomain takeovers and other DNS tomfoolery
 
@@ -38,10 +38,11 @@ options:
   -c CUSTOM_SIGNATURES, --custom-signatures CUSTOM_SIGNATURES
                         Use an alternate directory for loading signatures
   -l, --list-modules    List available modules and their descriptions.
-  -s, --silent          Show only vulnerable targets
+  -s, --silent          Only show results, no other output (JSON format)
   -m MODULES, --modules MODULES
                         Comma separated list of module names to use. Ex: module1,module2,module3
   -d, --debug           Enable debug logging
+  -D, --direct          Enable direct mode
 
 ```
 ## Modules
@@ -54,6 +55,10 @@ options:
 | references | Check HTML content for links or other references that contain a hijackable domain |
 | txt | Check TXT record contents for hijackable domains |
 | zonetransfer | Attempt a DNS zone transfer |
+| dmarc | Check for missing or misconfigured DMARC records |
+| mta-sts | Check for MTA-STS misconfigurations and dangling mta-sts subdomains |
+| wildcard | Check for wildcard DNS records that could enable domain-wide subdomain takeover |
+| spf | Check for missing or misconfigured SPF records and hijackable include/redirect domains |
 
 ## Examples
 

baddns/base.py

@@ -1,9 +1,13 @@
 import logging
 
+from cloudcheck import CloudCheck
+
 log = logging.getLogger(__name__)
 
 
 class BadDNS_base:
+    skip_cloud_targets = False
+
     def __init__(
         self,
         target,
@@ -32,6 +36,18 @@ def infomsg(self, msg):
         else:
             log.debug(msg)
 
+    async def dispatch(self):
+        if any(label.startswith("_") for label in self.target.split(".")):
+            log.debug(f"Skipping SRV-style target [{self.target}], SRV-style subdomains are not supported")
+            return False
+        if self.skip_cloud_targets and await CloudCheck().lookup(self.target):
+            log.debug(f"Skipping cloud provider target [{self.target}] for module [{self.__class__.__name__}]")
+            return False
+        return await self._dispatch()
+
+    async def _dispatch(self):
+        raise NotImplementedError
+
     async def cleanup(self):
         pass