PassiveDNS::Client

gem 'passivedns-client'

$ bundle

$ gem install passivedns-client

[dnsdb]
APIKEY = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
[virustotal]
APIKEY = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
[passivetotal]
USERNAME = tom@example.com
APIKEY = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
[circl]
USERNAME = circl_user
PASSWORD = circl_pass
[riskiq]
API_TOKEN = 0123456789abcdef
API_PRIVATE_KEY = 01234567890abcdefghijklmnopqrstu

[circl]
AUTH_TOKEN = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

require 'passivedns/client'

c = PassiveDNS::Client.new(['riskiq','dnsdb'])
results = c.query("example.com")

Usage: bin/pdnstool [-d [cdprv]] [-g|-v|-m|-c|-x|-y|-j|-t] [-os <sep>] [-f <file>] [-r#|-w#|-v] [-l <count>] [--config <file>] <ip|domain|cidr>
Passive DNS Providers
  -dcdprv uses all of the available passive dns database
  -dc use CIRCL
  -dd use DNSDB
  -dp use PassiveTotal
  -dr use RiskIQ
  -dv use VirusTotal
  -dvr uses VirusTotal and RiskIQ (for example)

Output Formatting
  -g link-nodal GDF visualization definition
  -z link-nodal graphviz visualization definition
  -m link-nodal graphml visualization definition
  -c CSV
  -x XML
  -y YAML
  -j JSON
  -t ASCII text (default)
  -s <sep> specifies a field separator for text output, default is tab

State and Recursion
  -f[file] specifies a sqlite3 database used to read the current state - useful for large result sets and generating graphs of previous runs.
  -r# specifies the levels of recursion to pull. **WARNING** This is quite taxing on the pDNS servers, so use judiciously (never more than 3 or so) or find yourself blocked!
  -w# specifies the amount of time to wait, in seconds, between queries (Default: 0)
  -l <count> limits the number of records returned per passive dns database queried.

Specifying a Configuration File
  --config <file> specifies a config file. default: /home/chris/.passivedns-client

Getting Help
  -h hello there.  This option produces this helpful help information on how to access help.
  -v debugging information

	    attr_accessor :debug

		def initialize(options={})
		  @debug = options[:debug] || false
		  # please include a way to change the base URL, HOST, etc., so that people can test
		  # against a test/alternate version of your service
	      @base = options["URL"] || "http://myperfectdns.example.com/pdns.cgi?query="
		  @apikey = options["APIKEY"] || raise("APIKEY option required for #{self.class}")
		end

		# override
		def lookup(label, limit=nil)
			$stderr.puts "DEBUG: #{self.class.name}.lookup(#{label})" if @debug
			recs = []
			Timeout::timeout(240) {
				t1 = Time.now
				# TODO: your code goes here to fetch the data from your service
				# TODO: don't forget to impose the limit either during the fetch or during the parse phase
				response_time = Time.now - t1
				# TODO: parse your data and add PDNSResult objects to recs array
				recs << PDNSResult.new(self.class.name, response_time, rrname ,
					rdata, rrtype, ttl, first_seen, last_seen, count )
			}
			recs
		rescue Timeout::Error => e # using the implied "begin/try" from the beginning of the function
			$stderr.puts "#{self.class.name} lookup timed out: #{label}"
		end
  end
	end
end