class Zetalytics::Api
Public Class Methods
# File lib/zetalytics.rb, line 9 def initialize(api_key=nil, options={}) @base_uri = "https://zonecruncher.com/api/v2" @api_key = api_key # if we weren't passed a config unless @api_key # check to see if a config file exists config_file_path = "#{File.dirname(__FILE__)}/../config/config.json" if File.exist? config_file_path config = JSON.parse(File.open(config_file_path,"r").read) @api_key = config["api_key"] else raise "Unable to continue... no api key!" end end end
Public Instance Methods
Search passive dns by hostname for mixed resource record types
# File lib/zetalytics.rb, line 227 def search_by_hostname (domain) result = JSON.parse RestClient.get "#{@base_uri}/hostname?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by IP, CIDR, or Range (v6 compatible)
# File lib/zetalytics.rb, line 237 def search_by_ip (ip) result = JSON.parse RestClient.get "#{@base_uri}/ip?q=#{ip}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search for domains sharing a registration email address or SOA email from passive
# File lib/zetalytics.rb, line 187 def search_by_unique_email_address (email) result = JSON.parse RestClient.get "#{@base_uri}/email_address?q=#{email}&token=#{@api_key}" if result["total"] > 0 return result else return end end
# File lib/zetalytics.rb, line 27 def search_cname2qname (cname) result = JSON.parse RestClient.get "#{@base_uri}/cname2qname?q=#{cname}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for CNAME records
# File lib/zetalytics.rb, line 59 def search_domain2cname (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2cname?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for A (IPv4) records
# File lib/zetalytics.rb, line 80 def search_domain2ip (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2ip?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search malware dns by domain (some of the results are obsolete)
# File lib/zetalytics.rb, line 90 def search_domain2malwaredns (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2malwaredns?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search malware http by domain (some of the results are obsolete)
# File lib/zetalytics.rb, line 100 def search_domain2malwarehttp (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2malwarehttp?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for MX records
# File lib/zetalytics.rb, line 110 def search_domain2mx (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2mx?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for NS records
# File lib/zetalytics.rb, line 120 def search_domain2ns (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2ns?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search name server glue (IP) records by domain name. NOTE: these are only the glue records found in gTLD zone files and NOT all IP records for every name server domain. what is dns glue record? => ns1.com/blog/glue-records-and-dedicated-dns#:~:text=What%20is%20a%20Glue%20Record,ns2.example.net%E2%80%9D.
# File lib/zetalytics.rb, line 133 def search_domain2nsglue (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2nsglue?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for PTR records
# File lib/zetalytics.rb, line 143 def search_domain2ptr (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2ptr?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for TXT records
# File lib/zetalytics.rb, line 153 def search_domain2txt (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2txt?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search historical whois records
# File lib/zetalytics.rb, line 165 def search_domain2whois (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2whois?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search zonefile changes by domain for DNAME record. A DNAME record creates an alias for an entire subtree of the domain name tree
# File lib/zetalytics.rb, line 38 def search_domain_dname_records (domain) domain_name = domain.split('.')[0] result = JSON.parse RestClient.get "#{@base_uri}/domain-zone-activity?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for AAAA (IPv6) records
# File lib/zetalytics.rb, line 49 def search_domain_for_ipv6_records (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2aaaa?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search for domains sharing a known registered email address or SOA email from passive
# File lib/zetalytics.rb, line 175 def search_email_address (domain) # using "a*@" is for identifying a large number of domains since the majority of DNS recorded contains else the administrator contact or abuse contact email = "a*@"+ domain result = JSON.parse RestClient.get "#{@base_uri}/email_address?q=#{email}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search for domains sharing a registration email address domain
# File lib/zetalytics.rb, line 197 def search_email_domain (domain) result = JSON.parse RestClient.get "#{@base_uri}/email_domain?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search malware dns by md5 hash
# File lib/zetalytics.rb, line 207 def search_hash2malwaredns (hash) result = JSON.parse RestClient.get "#{@base_uri}/hash2malwaredns?q=#{hash}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search historical d8s records and/or live d8s
# File lib/zetalytics.rb, line 69 def search_historical_live_dnsrecords (domain) result = JSON.parse RestClient.get "#{@base_uri}/domain2d8s?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search malware dns by IP
# File lib/zetalytics.rb, line 247 def search_ip2malwaredns(ip) result = JSON.parse RestClient.get "#{@base_uri}/ip2malwaredns?q=#{ip}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search malware http by IP/CIDR for x.x.x.x/ (not the IP a hostname resolved to). These results would not appear in the malware dns result since they do not require a DNS lookup.
# File lib/zetalytics.rb, line 258 def search_ip2malwarehttp(ip) result = JSON.parse RestClient.get "#{@base_uri}/ip2malwarehttp?q=#{ip}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search name server glue (IP) records by IP, CIDR, or Range (v6 compatible) what is dns glue record? => ns1.com/blog/glue-records-and-dedicated-dns#:~:text=What%20is%20a%20Glue%20Record,ns2.example.net%E2%80%9D.
# File lib/zetalytics.rb, line 269 def search_ip2nsglue(ip) result = JSON.parse RestClient.get "#{@base_uri}/ip2nsglue?q=#{ip}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Perform a live DNS lookup for a domain
# File lib/zetalytics.rb, line 279 def search_livedns(domain) result = JSON.parse RestClient.get "#{@base_uri}/liveDNS?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by MX domain for any domain served by the MX domain
# File lib/zetalytics.rb, line 299 def search_mx2domain(nameserver) result = JSON.parse RestClient.get "#{@base_uri}/mx2domain?q=#{nameserver}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search current zone files and passive DNS for domains served by nameserver.
# File lib/zetalytics.rb, line 309 def search_ns2domain(nameserver) result = JSON.parse RestClient.get"#{@base_uri}/ns2domain?q=#{nameserver}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search zonefile changes by nameserver
# File lib/zetalytics.rb, line 289 def search_nszoneactivity(nameserver) result = JSON.parse RestClient.get "#{@base_uri}/ns-zone-activity?q=#{nameserver}&token=#{@api_key}" if result["total"] > 0 return result else return end end
Search passive dns by domain for a list of subdomains from any record type.
# File lib/zetalytics.rb, line 319 def search_subdomains(domain) result = JSON.parse RestClient.get "#{@base_uri}/subdomains?q=#{domain}&token=#{@api_key}" if result["total"] > 0 return result else return end end