Add -m/--maxdepth to specify levels of recursion. Fixes rbsec#32

Author: rbsec

README.md

@@ -22,6 +22,7 @@ dnscan.py (-d \<domain\> | -l \<list\>) [OPTIONS]
     -6 --ipv6                                 Scan for IPv6 records (AAAA)
     -z --zonetransfer                         Perform zone transfer and exit
     -r --recursive                            Recursively scan subdomains
+    -m --maxdepth                             Maximum levels to scan recursively
     -R --resolver <resolver>                  Use the specified resolver instead of the system default
     -T --tld                                  Scan for the domain in all TLDs
     -o --output <filename>                    Output to a text file

dnscan.py

@@ -98,7 +98,10 @@ def get_name(self, domain):
                     except NameError:
                         addresses.add(ipaddr(str(address)))
 
-                if domain != target and args.recurse:    # Don't scan root domain twice
+                if ( domain != target and \
+                     args.recurse and \
+                     domain.count('.') - target.count('.') <= args.maxdepth
+                     ):
                     add_target(domain)  # Recursively scan subdomains
             except:
                 pass
@@ -317,6 +320,7 @@ def get_args():
     parser.add_argument('-6', '--ipv6', help='Scan for AAAA records', action="store_true", dest='ipv6', required=False, default=False)
     parser.add_argument('-z', '--zonetransfer', action="store_true", default=False, help='Only perform zone transfers', dest='zonetransfer', required=False)
     parser.add_argument('-r', '--recursive', action="store_true", default=False, help="Recursively scan subdomains", dest='recurse', required=False)
+    parser.add_argument('-m', '--maxdepth', help='Maximal recursion depth (for brute-forcing)', dest='maxdepth', required=False, type=int, default=5)
     parser.add_argument('-R', '--resolver', help="Use the specified resolver instead of the system default", dest='resolver', required=False)
     parser.add_argument('-T', '--tld', action="store_true", default=False, help="Scan for TLDs", dest='tld', required=False)
     parser.add_argument('-o', '--output', help="Write output to a file", dest='output_filename', required=False)