DNS protocol can be modelled in Nuclei with ease. Fully Customizable DNS requests can be sent by Nuclei to nameservers and matching/extracting can be performed on their response.

DNS Requests start with a dns block which specifies the start of the requests for the template.

# Start the requests for the template right here
dns:

​
Type

First thing in the request is type. Request type can be A, NS, CNAME, SOA, PTR, MX, TXT, AAAA.

# type is the type for the dns request
type: A

​
Name

The next part of the requests is the DNS name to resolve. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with {{ and end with }} and are case-sensitive.

  1. FQDN - variable is replaced by the hostname/FQDN of the target on runtime.

An example name value:

name: {{FQDN}}.com
# This value will be replaced on execution with the FQDN.
# If FQDN is https://this.is.an.example then the
# name will get replaced to the following: this.is.an.example.com

As of now the tool supports only one name per request.

​
Class

Class type can be INET, CSNET, CHAOS, HESIOD, NONE and ANY. Usually it’s enough to just leave it as INET.

# method is the class for the dns request
class: inet

​
Recursion

Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it’s better to leave it as true.

# Recursion is a boolean determining if the request is recursive
recursion: true

​
Retries

Retries is the number of attempts a dns query is retried before giving up among different resolvers. It’s recommended a reasonable value, like 3.

# Retries is a number of retries before giving up on dns resolution
retries: 3

​
Matchers / Extractor Parts

Valid part values supported by DNS protocol for Matchers / Extractor are -

ValueDescription
requestDNS Request
rcodeDNS Rcode
questionDNS Question Message
extraDNS Message Extra Field
answerDNS Message Answer Field
nsDNS Message Authority Field
raw / all / bodyRaw DNS Message

​
Example DNS Template

The final example template file for performing A query, and check if CNAME and A records are in the response is as follows:

id: dummy-cname-a

info:
  name: Dummy A dns request
  author: mzack9999
  severity: info
  description: Checks if CNAME and A record is returned.

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    matchers:
      - type: word
        words:
          # The response must contain a CNAME record
          - "IN\tCNAME"
          # and also at least 1 A record
          - "IN\tA"
        condition: and

More complete examples are provided here

DNS protocol can be modelled in Nuclei with ease. Fully Customizable DNS requests can be sent by Nuclei to nameservers and matching/extracting can be performed on their response.

DNS Requests start with a dns block which specifies the start of the requests for the template.

# Start the requests for the template right here
dns:

​
Type

First thing in the request is type. Request type can be A, NS, CNAME, SOA, PTR, MX, TXT, AAAA.

# type is the type for the dns request
type: A

​
Name

The next part of the requests is the DNS name to resolve. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with {{ and end with }} and are case-sensitive.

  1. FQDN - variable is replaced by the hostname/FQDN of the target on runtime.

An example name value:

name: {{FQDN}}.com
# This value will be replaced on execution with the FQDN.
# If FQDN is https://this.is.an.example then the
# name will get replaced to the following: this.is.an.example.com

As of now the tool supports only one name per request.

​
Class

Class type can be INET, CSNET, CHAOS, HESIOD, NONE and ANY. Usually it’s enough to just leave it as INET.

# method is the class for the dns request
class: inet

​
Recursion

Recursion is a boolean value, and determines if the resolver should only return cached results, or traverse the whole dns root tree to retrieve fresh results. Generally it’s better to leave it as true.

# Recursion is a boolean determining if the request is recursive
recursion: true

​
Retries

Retries is the number of attempts a dns query is retried before giving up among different resolvers. It’s recommended a reasonable value, like 3.

# Retries is a number of retries before giving up on dns resolution
retries: 3

​
Matchers / Extractor Parts

Valid part values supported by DNS protocol for Matchers / Extractor are -

ValueDescription
requestDNS Request
rcodeDNS Rcode
questionDNS Question Message
extraDNS Message Extra Field
answerDNS Message Answer Field
nsDNS Message Authority Field
raw / all / bodyRaw DNS Message

​
Example DNS Template

The final example template file for performing A query, and check if CNAME and A records are in the response is as follows:

id: dummy-cname-a

info:
  name: Dummy A dns request
  author: mzack9999
  severity: info
  description: Checks if CNAME and A record is returned.

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    matchers:
      - type: word
        words:
          # The response must contain a CNAME record
          - "IN\tCNAME"
          # and also at least 1 A record
          - "IN\tA"
        condition: and

More complete examples are provided here