Performing a masscan on an input file containing domain names - linux

Question

I cannot find any options in order to perform a masscan on an input file containing domain names in the following format:
domain-name1.com
domain-name2.org
domain-name3.net
Is there a way I could use masscan with an input file containing those domain names? If the masscan software cannot perform that, would you see any Linux programs that could it that would be fast like masscan?

Answer 1

You can use GNU's parallel in combination with dig or host to do performative mass DNS resolution. A combination of dig and parallel would be the following:
parallel -j100 --retries 3 dig #$nameserver +short :::: hosts.txt | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' > ip_list.txt
The number after -j switch is the amount of parallel DNS queries you want to execute;
+short tells dig to output only the DNS resolved addresses;
grep filters out only IP addresses, so we don't get MX entries, or any other unresolved addresses;
hosts.txt is the input file, containing hostnames;
ip_list.txt is the output file, which will be used to feed masscan.
Then you can feed masscan with your generated ip_list.txt as demonstrated:
masscan -iL ip_list.txt -p 80
edit
I found another command that can achieve the same parallel effect, but it's a bit more exciting as it's easier, which is xarg,an example syntax on how to use it is the following:
cat hosts.txt | xargs -n1 -P100 dig +short +retry=3 | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' > ip_list.txt
-P100 specifies 100 parallel processes;
-n1 gets only the first argument of a line from hosts.txt (changing it to higher shouldn't have any effect, as long as the input file has only hostnames separated by newlines);
The downside of this approach is that xargs doesn't retry if dig fails, but I used +retry for that;

Answer 2

masscan does not provide any option to run scan on domain name you have to provide it list of ip address. So if you have a list of domain names in a file you can use following script to get ip address of all the domains.
$ cat hosts
github.com
google.com
pentestmonkey.com
script:
import sys
import socket
read_file = open('hosts','r')
for host in read_file:
print socket.gethostbyname(host.rstrip("\n")) #rstrip for removing new line characters
read_file.close()

Answer 3

From the Comparison with Nmap section of the masscan README.md:
You can think of masscan as having the following settings permanently
enabled:
...
-n: no DNS resolution happens
So that tool will not facilitate conversion of the host names to IP addresses. You'll need to do that using a tool like host or dig and then feed the results into masscan.
massscan can read scan ranges (i.e. IP addresses and CIDR blocks) from a file, using the -iL <filename> flag.
Also worth mentioning, here's another excerpt from README.md:
Scanning the entire Internet is bad. For one thing, parts of the
Internet react badly to being scanned. For another thing, some sites
track scans and add you to a ban list, which will get you firewalled
from useful parts of the Internet.
If the "millions of domain names" aren't under your control, the warning above is applicable.

Answer 4

Use a high-speed (parallel or async) mass DNS resolver (massdns, fernmelder, etc.) to get the IP addresses for each DNS name efficiently. Use the IP addresses as input for masscan. If you'd like, you can plug the DNS names back in to the masscan JSON output with a dozen lines of Python.
Unless you're working on a very small scale, do NOT use Python or nmap to do your DNS resolution. You need native code to do this well, hence the recommendation for massdns or fernmelder