https://github.com/vulnquest58/dnsphantom
� Overview
DNSPhantom is a professional-grade DNS reconnaissance framework designed for security auditors, bug hunters, and penetration testers. Unlike traditional brute-forcing scripts, DNSPhantom utilizes an asynchronous architecture (asyncio + dnspython) combined with a dynamic resolver-health feedback loop, active risk assessment scoring, and relational network graph models to map target topologies efficiently.

�️ Key Features
� High-Speed Asynchronous Scanning: Fully async architecture allows querying thousands of DNS records concurrently under a custom rate-limiter.
� Resolver Pool & Feedback Loop: Auto-rotates multiple public and custom DNS resolvers, dynamically scoring them (0-100) based on successful queries, connection timeouts, and response latencies to automatically isolate slow or toxic nameservers.
�️ Advanced CDN / Hosting & Origin IP Classifier: Ported from VulnTrace (AdvancedCDNDetector logic). Integrates an active classification pipeline that categorizes resolved subdomains into four priority levels:
� Target Direct: Directly owned targets (e.g. ByteDance, TikTok networks).
� Hosting: General cloud environments (AWS, GCP, Azure, DigitalOcean, Linode, Hetzner, etc.).
� Potential Origin: Direct web IPs showing no CDN proxy or hosting signature.
� CDN Cache: Active proxy nodes (Cloudflare, Akamai, Fastly, Cloudfront, Imperva, etc.).
� Multi-Source Subdomain Discovery:
Brute-Force Module: Dictionary attacks utilizing customized subdomain lists.
Certificate Transparency (CT) Logs: Scraping SSL/TLS certificates via crt.sh.
Zone Transfer Module (AXFR): Identifies misconfigured name servers exposing internal zones.
DNS History Module: Searches historical IP mappings.
� Subdomain Takeover Detection: Actively resolves CNAME chains and matches them against 20+ vulnerability signatures (GitHub Pages, AWS S3/CloudFront, Azure, Shopify, Vercel, Netlify, etc.).
� Risk Scoring Engine: Classifies discovered assets into risk levels (Critical, High, Medium, Low, Info) using a custom scoring matrix that analyzes keywords (e.g. vpn, secure, admin, db) and vulnerable configurations.
�️ Network Graph Correlator: Models DNS relations (Subdomain → IP → NS → MX → CNAME) into a structural network graph, calculating connections and identifying centralization nodes.
�️ Persistent Storage: Saves historical scan metadata, target settings, summary statistics, and vulnerabilities into an optimized SQLite database (dnsphantom.db).
� Comprehensive Export Formats:
CLI: Modern terminal visualization with real-time logging.
Markdown: Executive summary reports.
JSON: Normalized structured output alongside relational network graph files.
HTML Dashboard: Interactive, beautifully designed dark-mode web dashboard showing data summaries, interactive node maps, and ranked vulnerabilities.
�️ Architecture
The framework operates sequentially through 7 automated execution phases:

              ┌────────────────────────────────────────┐
              │                 Target                 │
              └───────────────────┬────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │       PHASE 1: DISCOVERY (Parallel Async)        │
         │  • Subdomain Brute Force   • Zone Transfer       │
         │  • crt.sh CT Scraper       • DNS Resolver Pool   │
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │       PHASE 2: ANALYSIS (Dependent Async)        │
         │  • CNAME Takeover Check    • DNS History Record  │
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │              PHASE 3: CORRELATION                │
         │  • Deduplication Engine    • Target Subdomain Merging│
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │             PHASE 4: RISK SCORING                │
         │  • Threat Matrix Check     • Priority Scoring    │
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │           PHASE 5: GRAPH REPRESENTATION          │
         │  • Topology mapping        • Central Node Discovery│
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │         PHASE 6: IP CLASSIFICATION & FILTER       │
         │  • Origin IP Detection     • CDN & Hosting Checks│
         └────────────────────────┬─────────────────────────┘
                                  │
                                  ▼
         ┌──────────────────────────────────────────────────┐
         │                 PHASE 7: EXPORT                  │
         │   • SQLite     • JSON     • Markdown    • HTML   │
         └──────────────────────────────────────────────────┘

� Directory Structure
dnsphantom/
├── main.py # Main CLI application entrypoint
├── filter_origin.py # CDN, Hosting & Origin IP classification utility
├── config.yaml # Core configuration settings (resolvers, modules, rates)
├── requirements.txt # Python dependency list
├── dnsphantom.db # SQLite database storing scan results
├── core/
│ ├── context.py # Scan state sharing context
│ ├── module.py # Base abstract class for discovery modules
│ ├── ratelimit.py # Token-bucket rate-limiting implementation
│ └── resolver.py # Multi-nameserver rotation & health scoring logic
├── modules/
│ ├── subenum.py # Dictionary brute-forcing engine
│ ├── crtsh.py # CT logs subdomain harvester
│ ├── zonexfer.py # DNS Zone transfer (AXFR) vulnerability scanner
│ ├── takeover.py # CNAME vulnerability matching engine
│ └── history.py # Historic DNS database resolver
├── correlator/
│ ├── dedup.py # Deduplicates and merges subdomain structures
│ ├── scorer.py # Vulnerability risk priority scoring matrix
│ └── graph.py # Node-link network topology builder
├── storage/
│ └── sqlite.py # DB engine interface for metadata extraction
├── output/
│ ├── cli.py # Styled terminal standard output (incorporates classification renders)
│ ├── json_output.py # Structured JSON exporter
│ ├── markdown.py # Markdown executive report generator
│ └── html_dashboard.py # Interactive visual HTML dashboard generator
├── wordlists/
│ └── subdomains.txt # Customized domain prefix list
└── reports/ # Output directory for exported reports (HTML, JSON, MD)
� Installation & Setup
Clone the repository:

git clone https://github.com/vulnquest58/dnsphantom.git
cd dnsphantom
Install Dependencies:

pip install -r requirements.txt
Required packages:

dnspython (Asynchronous DNS resolution client)
aiohttp (Asynchronous HTTP library)
pyyaml (YAML parser)
click (Elegant CLI arguments handler)
� Configuration (config.yaml)
Define your scan preferences inside config.yaml:

DNS resolvers rotation list

resolvers:

• "8.8.8.8"
• "8.8.4.4"
• "1.1.1.1"
• "1.0.0.1"
• "9.9.9.9"

Default request timeout limit

timeout: 5.0

Global Rate limiting (Queries Per Second)

rate_limit: 100

Subdomain Scan options

modules:
subenum:
enabled: true
wordlist: "wordlists/subdomains.txt"
takeover:
enabled: true
zonexfer:
enabled: true
history:
enabled: false
api_key: ""
� Usage

Run basic scan against target domain

python main.py target.com

Use customized config file and set query timeout limit to 2 seconds

python main.py target.com --config custom-config.yaml --timeout 2.0

Execute scans without generating report files (JSON, Markdown, Dashboard, or DB)

python main.py target.com --no-json --no-markdown --no-html --no-db
Command Options
Usage: main.py [OPTIONS] TARGET

Options:
-c, --config TEXT Config file path (default: config.yaml)
-t, --timeout FLOAT DNS query timeout in seconds (default: 5.0)
--no-json Disable exporting JSON reports
--no-markdown Disable exporting Markdown reports
--no-html Disable generating HTML dashboard reports
--no-db Disable persistent database storage
--help Show this message and exit.
� Export Reports
By default, every scan exports detailed reports into the reports/ directory:

HTML Dashboard (reports/target_dashboard.html): Features graphs, donut charts highlighting vulnerabilities by threat category, subdomain tables with search filters, CNAME chains, and risk priorities.
Markdown Report (reports/target_report.md): A clean structured markdown document listing risk findings, recommendations, and target host statistics.
JSON Output (reports/target_results.json): Contains raw findings, deduplicated records, and complete metadata ready to be parsed by security pipelines.
Graph JSON (reports/target_graph.json): Graph-node database structure detailing network topology linkages.