Reply

Dangling CNAME Report

[ Edited ]
Adviser
Posts: 144
1297     0

Dangling CNAMEs are essentially CNAMEs in your authoritative zone that point to 3rd party recourses that no longer exist and could be reused by adversaries as a subdomain takeover.

 

This concern has come up a few times so this basic solution is what I came up with working within the confines of the Infoblox NIOS Reporting platform:

 

High level: 

 

  • CSV export all CNAMEs from a zone via GUI or API (be sure to export in Infoblox CSV import format)
  • Upload this CSV file to Reporting as a lookup and add a lookup definition
  • Load the Dangling CNAMEs dashboard

 

This will provide a report of all CNAMEs in a zone that fail to resolve to an IP address.

 

This could be run as a scheduled report to keep the results automatically updated and also trigger alerts and/or send an email with the results.

 

There are some issues which include keeping the current list of CNAMEs current as this would require periodic updating and there is not an API/automatic method to push this into the Reporting. The other issue is that the available dnslookup Splunk script only looks up A records. If a CNAME happens to point to a name that only has a TXT record, for example, it won’t resolve and would therefore show up on the list of unresolved CNAMEs in the report.

 

Here is a sample of what the report would look like and how to build it:

 

Example API call to create the CSV export (or just grab it fro the GUI):

 

curl --location --request POST 'https://gridmaster/wapi/v2.9/fileop?_function=csv_export' \
--header 'Content-Type: application/json' \
--data-raw '{
    "_object": "record:cname",
    "zone":"domain-name.tld"
    }'

To upload a lookup table: Reporting -> Settings -> Lookups ->  add-new:

 

image001.png

 

Choose upload CSV file and save as cnames.csv:

 

image002.png

 

Add-new for lookup definition and add as cnames from lookup file cnames.csv:

 

image003.png

 

Go to Reporting - > Dashboards -> Create new dashboard:

 

image004.png

 

Create Dashboard and then select “Source” to edit the source. Completely replace the XML with the below snippet and save:

 

<dashboard>
  <label>Dangling CNAMEs</label>
  <row>
    <panel>
      <title>Total Dangling CNAMEs</title>
      <single>
        <search>
          <query>| inputlookup cnames |  lookup dnslookup clientip as fqdn* OUTPUT clienthost as Resolved | where isnull(Resolved) | stats count by fqdn* | eventstats sum(count) as Total | dedup Total | table Total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>CNAMEs not resolved</title>
      <table>
        <search>
          <query>| inputlookup cnames |  lookup dnslookup clientip as fqdn* OUTPUT clienthost as Resolved  | where isnull(Resolved) | stats count by fqdn*  | eventstats sum(count) as totalCount | transpose | replace "fqdn*" with FQDN | transpose header_field=column | table FQDN</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Now you should have a dashboard similar to this which contains the total and full list of all the dangling CNAMEs:

 

image005.png

 

Reminder... this requires the manual upload (and updating) of the list of CNAMEs to monitor and the report will list "false positives" if a CNAME fails to resolve to an IP address for any other reason.

 

Hope this helps someone!

Steve S.

Re: Dangling CNAME Report

Authority
Posts: 15
1298     0

Hi Steve,

 

We were looking for something like this and we are trying to get this to work but get stuck.

We followed the instructions below, but we see a yellow exclamation mark in the dashboard saying that the file name cnames-csv is invalid.

We copied your XML exactly as is.

Is there a typo in the XML somewhere ?

 

Re: Dangling CNAME Report

Adviser
Posts: 144
1298     0

Thank you for catching an issue! Appears I did have a couple of typos in the XML. I have updated the XML in the original post. Go ahead and copy/replace with the full updated XML and this should now work as expected.

Steve S.

Re: Dangling CNAME Report

Techie
Posts: 3
1298     0

HI Steve,

 

Thx for resolving the issue with the XML.

As we have implemented according to your instructions.

The Dashboard works fine as far as i can see, but still it says No Results Found.

Evendough we have created the CSV file, and have setup de LookUp Table File and the LookUp Definitions. 

 

LookUp Table File:

/opt/splunksearchhead/etc/apps/infoblox/lookups/cnames.csv

 

LookUp Definition:

cnames
file
Id,CName,CanonicalName,Owner,IpAddresses,ExportDateTimecnames.csv

 

Any idea on what might cause this, since we do not get the required output?

 

Thx in advance.

Grtzz

 

Mervin Alvares

 

Re: Dangling CNAME Report

Adviser
Posts: 144
1298     0

Hello Mervin,

 

Apologies as this appears to be my fault once again Smiley Happy The CSV export of the CNAMES must be in "CSV Import" format and not the "visible data" format.

 

When you export via the GUI be sure to choose the CSV export option of "Export data in Infoblox CSV Import Format".

 

 

I believe this may be the issue and please let me know if this is the case. You will need to generate a new export and remove/replace the cnames.csv you have uploaded and the corresponding LookUp Table file as the field mappings are different.

 

Thank you!

 

 

Steve S.

Re: Dangling CNAME Report

Techie
Posts: 3
1298     0

Hi Steve,

 

Can you explain how i can get a CSV with C-Names from the infoblox GUI?

Since i can't find the option in our Grid Manager.

 

And maybe you could clarify what you mean with:  "CSV Import" format?

And how to?

 

Re: Dangling CNAME Report

Adviser
Posts: 144
1298     0

Hi Mervin,

 

Yes, I had intended to include a screen shot in my last reply but unfortunately this did not appear.

 

To generate the CSV in Infoblox Import format you can follow these steps:

 

1. Navigate to the zone you wish to generate the CNAME export from

2. Apply a filter for Type Equals CNAME record

3. Choose the "Export" function and then the option for "Export data in Infoblox CSV Import Format"

 

This will provide a CSV output in a different format that is compatible with the CSV import function and also the expected format and columns for the Dangling CNAME Report to properly extract the data.

 

See the screen shot below for a visual example:

 

csv.jpg

 

Thank you!

Steve S.

Re: Dangling CNAME Report

Techie
Posts: 3
1298     0

Hi Steve,

 

I have managed to get the dashboard working, thx for you help.

 

Still i have a question:

The dashboard says there are a total of 528 Dangling cnames, but shows only 5 in the "CNAMEs not resolved" view.Capture.JPG

Re: Dangling CNAME Report

Adviser
Posts: 144
1298     0

I am glad to see this is at least partially working now!

 

I don't belive there was a limit set on the "CNAMEs not resolved" but perhaps there is a display issue. Can you open this panel in a search to confirm if this diplays the full listing? Hover over the lower right corner of the "CNAMEs not resolved" panel and select the magnifying glass. This should open with the actual search string being leveraged and display the results.

 

Let me know what you find and we can proceed from there.

 

Thank you!

Steve S.
Showing results for 
Search instead for 
Did you mean: 

Recommended for You