🛰️

DNSPhantom

Async DNS Recon Engine · VulnTrace Origin Classifier · Topology Graph Engine

A professional-grade DNS Reconnaissance & Security Auditing Framework combining asynchronous DNS resolution (`asyncio` + `dnspython`), a dynamic resolver-health feedback loop, multi-source subdomain discovery, CNAME takeover scanner with 20+ signatures, and an advanced CDN / Hosting / Origin IP Classifier ported from VulnTrace.

GitHub Repository

v0.2.0 Release Origin Classifier HTML Dashboard

Overview

DNSPhantom maps target network perimeters efficiently without hitting performance bottlenecks. Rather than relying on simple dictionary brute-forcing, DNSPhantom integrates a 7-stage automated pipeline that correlates discovered subdomains against threat scoring matrices, network topology graphs, and active IP classification engines.

Key Capabilities

🚀 Async Concurrent Queries: High-speed asynchronous queries managed under token-bucket rate limiters.
🔄 Resolver Pool Feedback Loop: Dynamically scores public DNS resolvers (0-100) based on latency and failure rates to auto-isolate toxic nameservers.
🛡️ VulnTrace Origin IP Classifier: Categorizes resolved subdomains into four priority levels:
- 🟢 Target Direct: Directly owned infrastructure (e.g., ByteDance networks).
- 🔵 Hosting: General cloud environments (AWS, GCP, Azure, DigitalOcean, Linode, Hetzner).
- 🟡 Potential Origin: Direct web IPs showing no CDN proxy or hosting signature.
- 🔴 CDN Cache: Active proxy nodes (Cloudflare, Akamai, Fastly, CloudFront, Imperva).
🎯 Subdomain Takeover Engine: Resolves CNAME chains against 20+ vulnerability signatures (GitHub Pages, AWS S3, Shopify, Vercel, Netlify).
📊 Risk Scoring & Graph Topology: Models network relationships (Subdomain → IP → NS → MX → CNAME) into exportable JSON graphs.

7-Phase Execution Architecture

Target ➔ Phase 1: Parallel Async Discovery (Brute-force, CT logs, AXFR)
        ➔ Phase 2: Analysis (Takeover checks & DNS History)
        ➔ Phase 3: Correlation & Deduplication Engine
        ➔ Phase 4: Threat Matrix Risk Assessment
        ➔ Phase 5: Topology Graph Construction
        ➔ Phase 6: IP Classification & Origin Detection (filter_origin)
        ➔ Phase 7: Multi-format Export (CLI, Markdown, JSON, HTML Dashboard)

Installation & Execution

# Clone the repository
git clone https://github.com/vulnquest58/dnsphantom.git
cd dnsphantom

# Install dependencies
pip install -r requirements.txt

# Execute target scan
python main.py target.com

Export Formats

By default, every scan exports detailed reports to reports/:

HTML Dashboard: Dark-mode interactive web dashboard with network node maps and charts.
Markdown Report: Executive summary detailing threat findings and recommendations.
JSON & Graph Files: Relational graph node files ready for security pipeline integration.