rapid7/metasploit-framework — pull request #2929 by xistence (2014-01-29 07:24:04+00:00)
Title: Added DNS recursion amplification scanner

This auxiliary module will test a DNS server for recursion and determine the size of the UDP reply. Based on this the DoS amplifier is calculated.
To easily test this in a private environment, setup a CentOS 5 VM and use the following steps:

- yum -y install caching-nameserver
- Edit the /etc/named.caching-nameserver.conf file and make it look like this:
options {
listen-on port 53 { any; };
directory	"/var/named";
};

- service named restart

msf > use auxiliary/scanner/dns/dns_amp
msf auxiliary(dns_amp) > set RHOSTS 192.168.2.132
RHOSTS => 192.168.2.132
msf auxiliary(dns_amp) > run
[*] Sending DNS probes to 192.168.2.132->192.168.2.132 (1 hosts)
[*] Sending 67 bytes to each host using the IN ANY isc.org request
[+] 192.168.2.132:53 - Response is 471 bytes [7.03x Amplification]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

With wireshark you can easily verify if the request/response bytes etc. are correct (This is what I did:))
It's also possible to change "IN ANY" request for "isc.org" to something else by using other query types and/or different domain:

msf auxiliary(dns_amp) > show options

Module options (auxiliary/scanner/dns/dns_amp):

Name Current Setting Required Description
---- --------------- -------- -----------
BATCHSIZE 256 yes The number of hosts to probe in each set
CHOST no The local client address
DOMAINNAME isc.org yes Domain to use for the DNS request
QUERYTYPE ANY yes Query type(A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, ANY)
RHOSTS 192.168.2.132 yes The target address range or CIDR identifier
RPORT 53 yes The target port
THREADS 1 yes The number of concurrent threads