Skip to content

fix(recon): parallelize Phase 10 CNAME dig with per-query timeouts - #185

Open
weibalangzi wants to merge 1 commit into
awarexone:mainfrom
weibalangzi:fix/recon-phase10-parallel-dig
Open

weibalangzi wants to merge 1 commit into
awarexone:mainfrom
weibalangzi:fix/recon-phase10-parallel-dig

Conversation

@weibalangzi

Copy link
Copy Markdown

Summary

  • Phase 10 takeover quick-check previously resolved CNAMEs serially with unbounded dig calls, which can stall the recon pipeline on large subdomain lists or hanging resolvers.
  • Run CNAME lookups in parallel via xargs -P (default concurrency 20, override with BB_TAKEOVER_PARALLEL).
  • Bound each lookup with dig +time=2 +tries=1.
  • Claimable-service fingerprint matching is unchanged.

Test plan

  • bash -n bughunter/tools/recon_engine.sh
  • Run recon against a target with many subdomains; confirm Phase 10 completes without multi-minute hangs on dead resolvers
  • BB_TAKEOVER_PARALLEL=5 still produces the same style of takeover_candidates.txt lines when CNAMEs match
  • Quick mode (--quick) still limits to the existing subdomain cap

Made with Cursor

Serial dig over hundreds of subdomains can stall recon when resolvers hang.
Run lookups via xargs -P and dig +time=2 +tries=1. Concurrency is tunable
with BB_TAKEOVER_PARALLEL (default 20). Fingerprint matching is unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant