Reverse DNS Lookups from the Command Line

Last week, I was received an email "from a friend" that invited me to create an account on some site in order to view "some pictures" he had sent me. The last step in the sign-up process included giving the site my gmail login information, which I was not about to do. At that point, I wondered if my friend was aware that I had been sent a message "from him". It turned out that he was not aware that the site had sent out an email to me. He did say, however, that he had gone through the signup process and had given the site his gmail login information. Following that, the site had sent emails to everyone it could find in his gmail account, telling them all that he had pictures he wanted to show them.

Needless to say, I found this rather disconcerting and wanted to find more information about the site. One of the things I did was to figure out what other subdomains the site has on its server.

It's easy enough to figure out the main ip address of a website. From there, finding many subdomains isn't hard. Most web hosting companies give out ip addresses in a somewhat sequential manner. Most companies sign up for their main servers all at the same time. This should mean that their servers' ip addresses are clustered around each other, which makes it easy to enumerate all of them and see if the resolved domain names for the ip addresses belong to the site. This is how I did this from the command line:

@del ips.txt 2>nul &cmd /c "for /l %i in (0, 1, 255) do @echo 216.157.72.%i >> ips.txt & @echo 216.157.73.%i >> ips.txt" & nslookup 2>nul < ips.txt > results.txt & type results.txt | find /i "wegame"

Yeah, I know it's a bit much all at once. This is how it looks made a bit more readable

@del ips.txt 2>nul &
cmd /c 
    "for /l %i in (0, 1, 255) do
        @echo 216.157.72.%i >> ips.txt &
        @echo 216.157.73.%i >> ips.txt" &
nslookup 2>nul < ips.txt > results.txt &
type results.txt | find /i "wegame"

So, I start out deleting any old ips.txt laying around, sending any error output to nul ( @del ips.txt 2>nul ). Then I run a for loop that generates ips in a separate cmd (hence the cmd /c). The for loop loops from 0 to 255 ( for /l %i in (0, 1, 255) ) and appends each loop value (%i) to the two ip addresses (216.157.72. and 216.157.73.). I chose to generate ips in this range because the main server's ip address is 216.157.72.224, almost in the middle of both ranges. After generating the ip addresses, I send the resulting file (ips.txt) to nslookup ( < ips.txt ), send any error output to nul ( 2>nul ), and output the results to a text file ( > results.txt ). I then type the contents of results.txt, piping the output to a find command that searches for the name "wegame" ( type results.txt | find /I "wegame" ). The output looks like this:

Name:    test3.wegame.com
Name:    test3.wegame.com
Name:    medproc3.wegame.com
Name:    medproc3.wegame.com
Name:    db2.wegame
Name:    db2.wegame
Name:    vip1.wegame.com
Name:    fw.wegame
Name:    medproc1.wegame
Name:    medproc1.wegame
Name:    medproc2.wegame
Name:    medproc2.wegame
Name:    test2.wegame
Name:    test2.wegame
Name:    test1.wegame
Name:    test1.wegame

You could also make it more verbose about what it is doing by changing it to look like this:

@echo . & @echo ------------------------------ & @echo . NSLOOKUP SCRIPT & @echo ------------------------------ & @echo . & @echo . Generating ips into ips.txt & @del ips.txt 2>nul & cmd /c "for /l %i in (0, 1, 255) do @echo 216.157.72.%i >> ips.txt & @echo 216.157.73.%i >> ips.txt" & @echo . Running nslookup on generated ips & @echo . (results outputted to results.txt) & nslookup 2>nul < ips.txt > results.txt & @echo . Searching results for [wegame] & type results.txt | find /i "wegame" & @echo . DONE!

The new output will look like this:

.
------------------------------
.      NSLOOKUP SCRIPT
------------------------------
.
.     Generating ips into ips.txt
.     Running nslookup on generated ips
.           (results outputted to results.txt)
.     Searching results for [wegame]
Name:    test3.wegame.com
Name:    test3.wegame.com
Name:    medproc3.wegame.com
Name:    medproc3.wegame.com
Name:    db2.wegame
Name:    db2.wegame
Name:    vip1.wegame.com
Name:    fw.wegame
Name:    medproc1.wegame
Name:    medproc1.wegame
Name:    medproc2.wegame
Name:    medproc2.wegame
Name:    test2.wegame
Name:    test2.wegame
Name:    test1.wegame
Name:    test1.wegame
.  DONE!

Removing .svn Folders (WINDOWS)

Sometimes I have to copy a folder for a school or work project that I manage with SVN. Usually I don't want to keep the original .svn folders. Instead of tediously going through each directory and deleting each .svn folder, I use something like this to delete all .svn folders in the current directory and subdirectories:

for /f "delims=^" %f in ('dir /s /b /a:D ^| findstr ".*\.svn$"') do @rmdir /s /q "%f"

You could make it be a little more verbose with it's output by using something like this:

@echo . & @echo Removing Directories: & @echo . & for /f "delims=^" %f in ('dir /s /b /a:D ^| findstr ".*\.svn$"') do @echo -- %f & @rmdir /s /q "%f"

In a more readable format, the command looks like:

@echo .
@echo Removing Directories:
@echo .

for /f "delims=^" %f in ('dir /s /b /a:D ^| findstr ".*\.svn$"') do
    @echo -- %f
    @rmdir /s /q "%f"

After sprinkling some new .svn folders throughout my hard drive, this is the resulting output:

.
Removing Directories:
.
-- C:\.svn
-- C:\Documents and Settings\.svn
-- C:\Documents and Settings\All Users\.svn
-- C:\Documents and Settings\All Users\Desktop\.svn
-- C:\Drivers\.svn
-- C:\Program Files\.svn
-- C:\Program Files\Adobe\.svn
-- C:\Program Files\Adobe\Reader 9.0\.svn
-- C:\WINDOWS\.svn

C:\>

Hope that helps :) Variations on this command have saved me a lot of time. If you need a better explanation of what everything does, let me know.

Hardlinks vs Softlinks?

Lately I've been devouring security blogs I find, almost to an extent where I'm trying to cut back because I find I am making excuses to put off my homework and studies just a little longer so I can read one more extremely interesting article. Not that it's really that bad, but it is something I enjoy doing tremendously.

Better get back to the topic of this post though: Hardlinks vs Softlinks. What prompted me to look more into this is a post on Command Line Kung Fu that talks about file linking. Paul started off talking about how to link files on *nix platforms, and then Ed comes back and talks about how windows doesn't have a way to do this.

This caught me way off guard. I thought "What about using fsutil to create a hardlink? For example, you could use something similar to the example below to create a hardlink to a file:

C:\>fsutil hardlink create newfile.txt oldfile.txt
Hardlink created for C:\newfile.txt <<===>> C:\oldfile.txt

My first reaction was that maybe Ed forgot about that command, but I quickly dismissed that notion. If anything I probably didn't understand why Ed didn't count using fsutil hardlink create as an option for creating links.

After re-reading the post, I noticed a special requirement at the beginning that said there should be only one original of the file(s)/directory. From what I knew about hardlinks and fsutil, new files that are hardlinks to an existing file also become "originals." This means that deleting the original file that hardlinks were made from will not make the hardlinked files useless. They each will still maintain a copy of the file contents and will still be linked to eachother.

After a little more research into the matter, I came up with several main differences between hardlinks and softlinks.

1. Softlinked files create something more akin to a shortcut to a file. This maintains only one original file.
2. Deleting a hardlinked file does not delete all other hardlinked files, and a file is never "fully" deleted until all hardlinks to it are deleted.
3. Softlinked files are useless without the original file
4. Hardlinks cannot be made to directories
5. Softlinks can be made to directories
6. Hardlinks must exist in the same filesystem

Also, it is not possible to create hardlinks to/from alternate data streams, which would be very interesting.

As it turns out, I was right in assuming that Ed knows what he is talking about :)