moorada/neferpitool

Neferpitool 是一款强大的工具，它无缝集成了 DNS 和 WHOIS 协议，可自动监控域名变更。通过利用速度更快且限制更少的 DNS 协议，Neferpitool 能够分析所有受监控域名的 DNS 记录，并实时验证其状态。这使得该工具能够快速筛选出未注册或因其他原因无法进行 WHOIS 监控的域名。 对于其余已注册的域名，Neferpitool 则利用限制较多但高度准确的 WHOIS 协议来提取有关该域名的关键信息。这包括域名所有者、注册日期以及域名注册信息的任何近期变更等详细信息。 通过结合这两种协议，Neferpitool 能够提供全面且高度准确的域名监控，让用户高枕无忧，因为他们会在任何可能影响其在线状态的变更发生时收到警报。 除了全面的域名监控功能外，Neferpitool 还可以作为打击钓鱼攻击的宝贵工具。监控所有域名的注册信息和状态（包括最近注册或最近更改所有权的域名）可以作为潜在钓鱼尝试的关键预警信号，让用户能够采取主动措施来保护自己和他们的信息。 此外，Neferpitool 构建了用户友好的 CLI 界面，使设置和管理域名监控变得十分容易。它还通过电子邮件提供详细的报告和警报，以确保用户始终了解其受监控域名的最新状态。 总的来说，对于任何想要时刻掌握其在线状态并保护其宝贵域名的人来说，Neferpitool 都是一款强大且不可或缺的工具。 ## 功能 * 生成和监控域名变体（typo-domains） * 识别并存储有关 typo-domains 状态的变更（有关 DNS 记录和 WHOIS 信息的状况） * 后台监控并通过电子邮件发送通知 * 配置扫描和显示参数 ## 安装 ``` git clone https://github.com/moorada/neferpitool.git cd neferpitool/cmd go build ``` ## 用法 制作配置文件 ``` ./cmd -mc ``` 通过交互式提示添加到监控或管理某个域名 ``` ./cmd github.com ``` 通过交互式提示运行 Neferpitool ``` ./cmd ``` 通过交互式提示管理某个特定的 typo-domain ``` ./cmd -td typodomain.example ``` ### Flags ``` -bg Active monitoring in background -it string -p string Import Typos from file : -main domain -path of the file -logs Avtive logs on file -mc Make config file -pd Check if domains are present -td string Manage one typodomain ``` ### 配置文件字段 ``` "TYPOSALGHORITM": List of typosquatting alghoritms "EXPIRATIONTIME": Number of days remaining until the domain expires for which to be notified by email "MAXATTEMPTSWHOIS": number of attempted WHOIS requests if there are failures "MAXATTEMPTSSOA": number of attempted DNS requests if there are failures "TIMETOSLEEPWHOIS": waiting time between requests "TIMETOSLEEPSOA": waiting time between requests "EMAIL": email used to send email "PASSWORD": "EMAILTONOTIFY": [] emails that will receive the email "SHOWSTATUS": [] Domains with states listed in this list will be displayed "PATHRESOLVER": Path of DNS solver (resolv.conf) "HOURSLEEPBACKGROUNDMONITORING": Waiting time between total scans in background mode "CHECKRELIABILITYTIME": When scanning for typodomains fails or is unreliable this time is waited before rescanning "REPORTFREQUENCY" [] List of Cron regex, indicates when to email the report, Model: cron.Second | cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow ``` ### 域名状态 typo-domains 的状态会根据是否存在以下 DNS 记录而变化： ``` UNKNOWN: in case of errors in DNS requests; INACTIVE: SOA or NS record is present, this indicates that the typodomain is no longer available for purchase. ``` 根据是否存在其他记录，typo-domain 可能会从 INACTIVE 状态进入 ALIAS 或 ACTIVE 状态； ``` ALIAS: if the CNAME record is present; ACTIVE: if A, AAAA or MX records are present; ``` ### Typosquatting 算法 ``` MD Missing Dot is created by omitting a dot from the domain. MDS Missing Dashes is created by stripping all dashes from the domain. CO Character Omission Omitting a character from the domain. CS Character Swap Swapping two consecutive characters in a domain ACS Adjacent Character Substitution replaces adjacent characters ACI Adjacent Character Insertion inserts adjacent character CR Character Repeat Repeats a character of the domain name twice DCR Double Character Replacement repeats a character twice. SD Strip Dashes is created by omitting a dash from the domain SP Singular Pluralise creates a singular domain plural and vice versa CM Common Misspellings are created from a dictionary of commonly misspelled words VS Vowel Swapping is created by swaps vowels HG Homoglyphs replaces characters with characters that look similar WTLD Wrong Top Level Domain W2TLD Wrong Second Level Domain W3TLD Wrong Third Level Domain HP Homophones Typos are created from sets of words that sound the same BF Bitsquatting relies on random bit-errors to redirect connections NS Numeral Swap numbers, words and vice versa ALL Apply all typosquatting algorithms ``` ## 待办事项 在 Docker 容器中运行 添加到监控或管理某个域名 ``` docker build -t neferpitool . ``` ## 用于测试的 DNS 参见 [DNS](dns)

标签：DNS, EVTX分析, WHOIS, 反钓鱼, 域名监控, 日志审计, 网络安全, 请求拦截, 隐私保护