saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/hunting-for-dns-based-persistence/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.6 KiB
Raw Blame History

API Reference: Hunting for DNS-based Persistence

SecurityTrails API

# Get current DNS records
curl -s "https://api.securitytrails.com/v1/domain/example.com" \
  -H "APIKEY: ${ST_API_KEY}"

# Get subdomains
curl -s "https://api.securitytrails.com/v1/domain/example.com/subdomains" \
  -H "APIKEY: ${ST_API_KEY}"

# Historical A records
curl -s "https://api.securitytrails.com/v1/history/example.com/dns/a" \
  -H "APIKEY: ${ST_API_KEY}"

# Historical NS records
curl -s "https://api.securitytrails.com/v1/history/example.com/dns/ns" \
  -H "APIKEY: ${ST_API_KEY}"

# WHOIS history
curl -s "https://api.securitytrails.com/v1/history/example.com/whois" \
  -H "APIKEY: ${ST_API_KEY}"

DNS Record Types to Hunt

Record Persistence Risk Detection
A/AAAA IP hijacking to attacker infra Compare against baseline
CNAME Subdomain takeover via dangling records Resolve target, check NXDOMAIN
NS Full zone delegation hijack Compare against registrar NS
MX Email interception Monitor for unauthorized MX
TXT C2 data exfiltration channel Check for encoded payloads
Wildcard (*) Catch-all subdomain resolution Test random subdomain resolution

Dangling CNAME Services (Subdomain Takeover)

Service CNAME Pattern Takeover Method
AWS S3 *.s3.amazonaws.com Create matching bucket
GitHub Pages *.github.io Create matching repo
Azure Web Apps *.azurewebsites.net Register app name
Heroku *.herokuapp.com Create matching app
Shopify *.myshopify.com Claim custom domain
CloudFront *.cloudfront.net Create matching distribution

dig Commands for Hunting

# Check all record types
dig ANY example.com +noall +answer

# Test for wildcard records
dig A randomtest123.example.com +short

# Check NS delegation chain
dig NS example.com +trace

# Verify DNSSEC
dig DNSKEY example.com +dnssec +short

# Check for zone transfer (authorized testing only)
dig AXFR example.com @ns1.example.com

MITRE ATT&CK DNS Techniques

Technique ID Description
DNS Hijacking T1584.001 Modify DNS records to redirect traffic
DNS Server T1583.002 Acquire DNS server for C2
Domain Fronting T1090.004 Use CDN to mask C2
DNS Tunneling T1572 Encode data in DNS queries

References