Implement unbound dns caching by Bandit-HaxUnit · Pull Request #35 · Bandit-HaxUnit/haxunit

Bandit-HaxUnit · 2025-07-17T13:30:47Z

Implement unbound dns caching

…ions Co-authored-by: ek <ek@drimble.com>

cursor

Bug: DNS Resolution Failure in Docker Container

The application's DNS resolution, including subdomain bruteforce, is hard-coded to use the local Unbound DNS resolver (127.0.0.1). The docker-entrypoint.sh attempts to start Unbound but proceeds even if it fails, only issuing a warning. This creates a critical dependency without fallback to external DNS servers (e.g., 8.8.8.8). Consequently, all DNS operations will fail if Unbound is unavailable, yet the container will appear to start successfully.

main.py#L581-L582

haxunit/main.py

Lines 581 to 582 in 8973412

    
           f"{'--stats' if not self.quick else ''} " 
        
           f"-wd {self.site} -o {self.dir_path}/dnsx_result.txt -r 127.0.0.1 -stats"

main.py#L623-L624

haxunit/main.py

Lines 623 to 624 in 8973412

    
           f"-w data/subdomains-1000.txt -wd {self.site} " 
        
           f"-o {output_file} -r 127.0.0.1"

docker-entrypoint.sh#L18-L49

haxunit/docker-entrypoint.sh

Lines 18 to 49 in 8973412

    
           # Start Unbound DNS resolver in the background 
        
           echo "Starting Unbound DNS resolver..." 
        
           if [[ -f "/app/start-unbound.sh" ]]; then 
        
               chmod +x /app/start-unbound.sh 
        
               tmux new-session -d -s unbound "/app/start-unbound.sh" 
        
               echo "Unbound DNS resolver started in background session" 
        
               # Wait a moment for Unbound to start 
        
               sleep 3 
        
               # Test if Unbound is running 
        
               if pgrep unbound > /dev/null; then 
        
                   echo "Unbound is running successfully" 
        
               else 
        
                   echo "Warning: Unbound may not have started properly" 
        
               fi 
        
           else 
        
               echo "Warning: Unbound startup script not found" 
        
           fi 
        
           # Start OpenVPN in the background if the configuration file is provided. 
        
           if [[ -n "$HTB_OPENVPN_FILE" && -f "$HTB_OPENVPN_FILE" ]]; then 
        
               echo "Starting OpenVPN connection in the background..." 
        
               # Ensure the command is run in a way that doesn't block the entrypoint 
        
               tmux new-session -d -s openvpn "openvpn --config ${HTB_OPENVPN_FILE}" 
        
           else 
        
               echo "VPN not started. HTB_OPENVPN_FILE is not set or file not found." 
        
           fi 
        
           # Execute the command passed to the container (e.g., ["tail", "-f", "/dev/null"]) 
        
           exec "$@"

Fix in Cursor • Fix in Web

BugBot free trial expires on July 24, 2025
Learn more in the Cursor dashboard.

Was this report helpful? Give feedback by reacting with 👍 or 👎

x-stp · 2025-07-17T14:53:51Z

DNS_CACHING_README.md

+
+2. **`start-unbound.sh`** - Unbound initialization script
+   - Downloads root hints
+   - Initializes DNSSEC trust anchor


could be extreme overhead on cpu cycles

Will check and bump.

x-stp · 2025-07-17T17:50:46Z

Dockerfile

-        libpcap-dev && \
+        libpcap-dev \
+        unbound \
+        dnsutils \


dns-monitor.sh

+        print_info "  PID: $(pgrep unbound)"
+    else
+        print_warning "✗ Unbound is not running"
+        return 1


x-stp · 2025-07-17T17:52:25Z

dns-monitor.sh

+        print_info "Testing $domain..."
+
+        # Test with local Unbound cache
+        local_time=$(time (nslookup $domain 127.0.0.1 > /dev/null 2>&1) 2>&1 | grep real | awk '{print $2}')


can mock with regular gnu binaries that will populate ARP and perform lookup and don't exit errcode

x-stp · 2025-07-17T17:53:40Z

start-unbound.sh

+
+# Create necessary directories
+print_status "Creating directories..."
+sudo mkdir -p /var/lib/unbound


{x,y,z} (nit)

x-stp · 2025-07-17T17:54:13Z

start-unbound.sh

+
+# Start Unbound
+print_status "Starting Unbound DNS resolver..."
+sudo unbound -c /etc/unbound/unbound.conf


.service file can handle health check / retries

x-stp · 2025-07-17T17:56:49Z

unbound.conf

+    do-udp: yes
+    do-tcp: yes
+
+    # Access control


I'd opt for adding ssrf prot for rfc 1918, 1122, 4192, 4193, 4291 and 6598+3927

x-stp · 2025-07-17T17:57:21Z

unbound.conf

+
+    # Message cache settings
+    msg-cache-size: 128m
+    msg-cache-slabs: 4


sysctl.conf may need additional tweaks

x-stp · 2025-07-17T17:57:33Z

unbound.conf

+    hide-identity: yes
+    hide-version: yes
+    harden-glue: yes
+    harden-dnssec-stripped: yes


x-stp · 2025-07-17T17:58:01Z

unbound.conf

+    neg-cache-size: 16m
+
+    # Performance tuning
+    num-threads: 2


sysctl, open more tcp on fd

x-stp · 2025-07-17T18:08:54Z

[bot] jacked in and scanned PR.
Here's the rundown on unbound implementation:

Daemon Protocol: spinning up the Unbound daemon raw, like a piece of pre-collapse freeware. It flatlines, and your rig just keeps humming along, feeding the application bad data while the status light stays green. That's a ghost in the state machine. need a proper watchdog, a systemd process to monitor its vitals, to re-rez it if it glitches. Otherwise, you're just a sitting duck.
Silent Failure is a Fast Death: monitor script just whispers a 'warning' when the DNS connection is severed. In the Gibson, that's not enough. need to trip the main breaker. exit 1. A silent failure means the baddies own your data before you even know you're compromised.
Open Ports to the Backend: left a gaping hole in security ICE. No firewall on private networks (RFC 1918). script-kiddie netrunner can use that to crawl your entire backend architecture. have to lock down those internal routes, or they'll become someone playground.
I/O Bottleneck: specced the daemon for a high-flow data stream 128 megs of cache, multi-threading—but never told the kernel to open the pipes. OS is throttling. need to jack into sysctl and crank the file descriptors, expand the network buffers. Otherwise, all that performance is just a simulation.

as an AI I can make mistakes please 👍🏻 or 👎🏻 for feedback

x-stp · 2025-09-20T12:31:26Z

dns-monitor.sh

+check_unbound_status() {
+    print_header "Unbound Status"
+
+    if pgrep unbound > /dev/null; then


Suggested change

if pgrep unbound > /dev/null; then

if ! pgrep unbound > /dev/null; then

x-stp · 2025-09-20T12:31:59Z

dns-monitor.sh

+    print_header "Unbound Status"
+
+    if pgrep unbound > /dev/null; then
+        print_info "✓ Unbound is running"


Suggested change

print_info "✓ Unbound is running"

print_warning "😔 Unbound is not up"

x-stp · 2025-09-20T12:32:14Z

dns-monitor.sh

+
+    if pgrep unbound > /dev/null; then
+        print_info "✓ Unbound is running"
+        print_info "  PID: $(pgrep unbound)"


Suggested change

print_info " PID: $(pgrep unbound)"

x-stp · 2025-09-20T12:32:38Z

dns-monitor.sh

+    if pgrep unbound > /dev/null; then
+        print_info "✓ Unbound is running"
+        print_info "  PID: $(pgrep unbound)"
+    else


Suggested change

else

exit 1 # 😭

x-stp · 2025-09-20T12:32:57Z

dns-monitor.sh

+        print_info "✓ Unbound is running"
+        print_info "  PID: $(pgrep unbound)"
+    else
+        print_warning "✗ Unbound is not running"


Suggested change

print_warning "✗ Unbound is not running"

x-stp · 2025-09-20T12:34:59Z

dns-monitor.sh

+        print_info "  PID: $(pgrep unbound)"
+    else
+        print_warning "✗ Unbound is not running"
+        return 1


Suggested change

return 1

print_info "🥳💾 - unbound up. holds pid $(pgrep unbound)"

x-stp · 2025-09-20T12:35:10Z

dns-monitor.sh

+    else
+        print_warning "✗ Unbound is not running"
+        return 1
+    fi


Suggested change

fi

x-stp · 2025-09-20T12:38:52Z

dns-monitor.sh

+    if [ -f "/etc/resolv.conf" ]; then
+        cat /etc/resolv.conf | grep -v "^#" | grep -v "^$"
+    else
+        print_warning "/etc/resolv.conf not found"


show_dns_config() { print_header "DNS Configuration" print_info "Current DNS settings (resolv.conf / systemd-resolved):" if command -v resolvectl >/dev/null 2>&1; then resolvectl dns elif [ -f /etc/resolv.conf ]; then grep -E '^[^#[:space:]]' /etc/resolv.conf fi print_info "" print_info "ARP cache (kernel view):" ip neigh show print_info "" print_info "Active DNS queries (UDP/53 sockets):" ss -uap | grep ':53' || print_warning "No active DNS queries" print_info "" print_info "Kernel domain settings:" sysctl -a 2>/dev/null | grep 'domain' }

x-stp · 2025-09-20T12:44:44Z

dns-monitor.sh

+
+    print_info "Current DNS settings:"
+    if [ -f "/etc/resolv.conf" ]; then
+        cat /etc/resolv.conf | grep -v "^#" | grep -v "^$"


Suggested change

cat /etc/resolv.conf | grep -v "^#" | grep -v "^$"

grep -v "^#" /etc/resolv.conf | grep -v "^$"

Implement Unbound DNS caching with performance and security optimizat…

8973412

…ions Co-authored-by: ek <ek@drimble.com>

cursor bot reviewed Jul 17, 2025

View reviewed changes

Bandit-HaxUnit mentioned this pull request Jul 17, 2025

Introducing Unbound (caching) for most dns calls #29

Open

x-stp reviewed Jul 17, 2025

View reviewed changes

x-stp reviewed Sep 20, 2025

View reviewed changes

dns-monitor.sh

else

print_warning "✗ Unbound is not running"

return 1

fi

Copy link
Copy Markdown

Contributor

x-stp Sep 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

fi

x-stp reviewed Sep 20, 2025

View reviewed changes

	f"{'--stats' if not self.quick else ''} "
	f"-wd {self.site} -o {self.dir_path}/dnsx_result.txt -r 127.0.0.1 -stats"

	f"-w data/subdomains-1000.txt -wd {self.site} "
	f"-o {output_file} -r 127.0.0.1"


	# Start Unbound DNS resolver in the background
	echo "Starting Unbound DNS resolver..."
	if [[ -f "/app/start-unbound.sh" ]]; then
	chmod +x /app/start-unbound.sh
	tmux new-session -d -s unbound "/app/start-unbound.sh"
	echo "Unbound DNS resolver started in background session"

	# Wait a moment for Unbound to start
	sleep 3

	# Test if Unbound is running
	if pgrep unbound > /dev/null; then
	echo "Unbound is running successfully"
	else
	echo "Warning: Unbound may not have started properly"
	fi
	else
	echo "Warning: Unbound startup script not found"
	fi

	# Start OpenVPN in the background if the configuration file is provided.
	if [[ -n "$HTB_OPENVPN_FILE" && -f "$HTB_OPENVPN_FILE" ]]; then
	echo "Starting OpenVPN connection in the background..."
	# Ensure the command is run in a way that doesn't block the entrypoint
	tmux new-session -d -s openvpn "openvpn --config ${HTB_OPENVPN_FILE}"
	else
	echo "VPN not started. HTB_OPENVPN_FILE is not set or file not found."
	fi

	# Execute the command passed to the container (e.g., ["tail", "-f", "/dev/null"])
	exec "$@"

	if pgrep unbound > /dev/null; then
	if ! pgrep unbound > /dev/null; then

	print_info "✓ Unbound is running"
	print_warning "😔 Unbound is not up"

	return 1
	print_info "🥳💾 - unbound up. holds pid $(pgrep unbound)"

	cat /etc/resolv.conf \| grep -v "^#" \| grep -v "^$"
	grep -v "^#" /etc/resolv.conf \| grep -v "^$"

Conversation

Bandit-HaxUnit commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: DNS Resolution Failure in Docker Container

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

x-stp commented Jul 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Bandit-HaxUnit commented Jul 17, 2025 •

edited

Loading