chkdm

#!/usr/bin/env bash

# chkdm (chkdomain)
# https://github.com/PeterDaveHello/chkdomain
# Copyright (C) 2022 ~ Peter Dave Hello
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.


# ColorEchoForShell #
# https://github.com/PeterDaveHello/ColorEchoForShell
# Copyright (C) 2015 ~ Peter Dave Hello
function echo.Red() {
  echo -e "\\033[31m$*\\033[m"
}

function echo.Green() {
  echo -e "\\033[32m$*\\033[m"
}

function echo.Cyan() {
  echo -e "\\033[36m$*\\033[m"
}

function echo.BoldBlack
{
    echo -e "\033[1;30m$*\033[m"
}
# ColorEchoForShell End #

function error() {
    echo.Red >&2 "$@"
    exit 1
}

if [ -z "$BASH_VERSION" ] || [ -z "$BASH" ]; then
    error "This script must be run in Bash shell"
fi

bash_major_version=""
if [ -n "${BASH_VERSINFO[0]:-}" ] && [ "${BASH_VERSINFO[@]+_}" ]; then
    bash_major_version="${BASH_VERSINFO[0]}"
elif [ -n "$BASH_VERSION" ]; then
    bash_major_version="$(echo "$BASH_VERSION" | cut -d'.' -f1)"
fi

if [ -z "$bash_major_version" ]; then
    error "Unable to determine Bash version"
elif [ "$bash_major_version" -lt 4 ]; then
    error "This script requires Bash 4.0 or later (detected bash major version: $bash_major_version)"
fi

if [ "$#" -ne "1" ]; then
    echo.Red "You need to give me just one domain name to run the check!"
    exit 1
fi

for cmd in dig nslookup sed head awk sort dirname readlink; do
    if ! command -v $cmd > /dev/null 2>&1; then
        error "command: $cmd not found!"
    fi
done

shopt -s extglob
domain="${1%%+(.)}"
# RFC 1035, 1123, 2181, 5891 compliant domain validation
if [[ ${#domain} -gt 253 ]] ||
    ! [[ "$domain" =~ ^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$ ]] ||
    [[ "$domain" =~ [a-zA-Z0-9-]{64,} ]] ||
    [[ "$domain" =~ -- ]]; then
    error "Invalid domain name format! Please use format like 'example.com' or 'sub.example.com'"
fi
shopt -u extglob

declare -A nofilterDNS secureDNS adblockDNS

nofilterDNS[AdGuard]="94.140.14.140"
nofilterDNS[Cloudflare]="1.1.1.1"
nofilterDNS[Gcore]="95.85.95.85"
nofilterDNS[Google]="8.8.8.8"
nofilterDNS[Hinet]="168.95.1.1"
nofilterDNS[UltraDNS]="64.6.64.6"
nofilterDNS[OpenDNS]="208.67.222.2"
nofilterDNS[Quad9]="9.9.9.10"
nofilterDNS[Yandex]="77.88.8.1"

secureDNS[CleanBrowsing]="185.228.168.9"
secureDNS[Cloudflare]="1.1.1.2"
secureDNS[Comodo]="8.20.247.20"
secureDNS[CONTROL D]="76.76.2.1"
secureDNS[UltraDNS]="156.154.70.2"
secureDNS[SafeDNS]="195.46.39.39"
secureDNS[OpenDNS]="208.67.222.222"
secureDNS[Quad101]="101.101.101.101"
secureDNS[Quad9]="9.9.9.9"
secureDNS[Yandex]="77.88.8.2"

adblockDNS[AdGuard]="94.140.14.14"
adblockDNS[CONTROL D]="76.76.2.2"
adblockDNS[dnsforge.de]="176.9.93.198"
adblockDNS[OVPN]="192.165.9.157"
adblockDNS[Tiarap]="188.166.206.224"

PaloAltoSinkholeCname="sinkhole.paloaltonetworks.com."
NextDNSBlockPageCname="blockpage.nextdns.io."
NextDNSBlockPageIP="$(dig +short $NextDNSBlockPageCname)"

function query() {
    domain="$1"
    dns="$2"
    filterDetect="$3"

    result="$(dig +short "$domain" @"$dns" | xargs)"
    echo "$result"

    if echo "$result" | grep -Eq "(^| )$PaloAltoSinkholeCname($| )"; then
        return 2
    elif [ "" != "$NextDNSBlockPageIP" ] && { echo "$result" | grep -Eq "(^| )$NextDNSBlockPageCname($| )" || [ "$NextDNSBlockPageIP" = "$result" ]; }; then
            return 3
    elif [ ";; connection timed out; no servers could be reached" = "$result" ]; then
        return 4
    elif echo "$result" | grep -E ";; communications error to $dns#[1-9]+: timed out"; then
        return 4
    elif echo "$result" | grep -E ";; communications error to $dns#[0-9]+: connection refused"; then
        return 5
    elif [ "filterDetect" != "$filterDetect" ]; then
        test "" != "$result"
        return $?
    fi

    # Determine if domain blocked by specified DNS
    #
    # Some DNS resolvers returned a not routable IP address,
    # some DNS resolvers returned a specified IP for blocked domain to display a notice page

    resultHead="$(echo "$result" | awk '{print $1}')"
    case "$resultHead" in
        # NXDOMAIN, CleanBrowsing & Quad9 return it for blocked domain (OpenDNS sometimes return NXDOMAIN)
        "") ;&
        # dnsforge.de or Pi-Hole based blockers
        "127.0.0.1" ) ;&
        # AdGuard
        "94.140.14.33" ) ;&
        # Cloudflare & CONTROL D blocked domain
        "0.0.0.0" | "::") ;&
        # SafeDNS blocked domain (blockpage.safedns.com)
        "127.0.0.2" | "195.46.39.1" ) ;&
        # UltraDNS
        "156.154.112.16" | "156.154.113.16") ;&
        # Comodo (warn.recursive.dnsbycomodo.com)
        "52.15.96.207") ;&
        # OpenDNS (hit-phish.opendns.com)
        "146.112.61.108") ;&
        # Yandex (safe1.yandex.ru)
        "safe1.yandex.ru." | "213.180.193.250" | "93.158.134.250" | "2a02:6b8::b10c:bad" | "2a02:6b8::b10c:babe")
            return 1 ;;
        # Other cases, consider properly resolved
        *)
            return 0 ;;
    esac
}

function detailQuery() {
    domain="$1"
    dns="$2"
    nslookup "$domain" "$dns" | sed -E -e 's/^(Server|Address):\t.+//g'  -e 's/.+answer:$//g' -e 's/^Name:\t+.+$//g' -e '/^$/d' -e 's/^/   /g' | sort -V | uniq
}

function chkDomain() {
    domain="$1"
    dns="$2"
    filterDetect="$3"
    queryResult="$(query "$domain" "$dns" "$filterDetect")"
    queryStatus="$?"
    if [ "0" = "$queryStatus" ]; then
        printf "%s" "$(echo.Green "OK!")"
        echo.BoldBlack " ($queryResult)"
    elif [ "1" = "$queryStatus" ]; then
        echo.Red "Failed!"
        detailQuery "$domain" "$dns"
    elif [ "2" = "$queryStatus" ]; then
        echo.Red "Palo Alto DNS Sinkhole detected!"
    elif [ "3" = "$queryStatus" ]; then
        echo.Red "NextDNS Block Page detected!"
    elif [ "4" = "$queryStatus" ]; then
        echo "Connection timed out ..."
    elif [ "5" = "$queryStatus" ]; then
        echo "Connection refused ..."
    else
        error "Unknown error"
    fi
}

function warnUpDNS() {
    echo "${nofilterDNS[*]} ${secureDNS[*]} ${adblockDNS[*]}" | sed 's/ /\n/g' | xargs -I{} -P5 dig +short "$domain" @{} > /dev/null 2>&1 &
}

function checkNofilterDNS() {
    echo.Cyan "\nRunning dig/nslookup over ${#nofilterDNS[@]} nofilter DNS:"
    keys=()
    while IFS='' read -r line; do keys+=("$line"); done < <(for DNS in "${!nofilterDNS[@]}"; do echo "$DNS"; done | sort)
    for DNS in "${keys[@]}"; do
        printf " - %s ... " "$DNS $(echo.BoldBlack "(${nofilterDNS[$DNS]})")"
        chkDomain "$domain" "${nofilterDNS[$DNS]}" noFilterDetect
    done
}

function checkSecureDNS() {
    echo.Cyan "\nRunning dig/nslookup over ${#secureDNS[@]} secure DNS:"
    keys=()
    while IFS='' read -r line; do keys+=("$line"); done < <(for DNS in "${!secureDNS[@]}"; do echo "$DNS"; done | sort)
    for DNS in "${keys[@]}"; do
        printf " - %s ... " "$DNS $(echo.BoldBlack "(${secureDNS[$DNS]})")"
        chkDomain "$domain" "${secureDNS[$DNS]}" filterDetect
    done
}

function checkAdblockDNS() {
    echo.Cyan "\nRunning dig/nslookup over ${#adblockDNS[@]} AD(and tracker)-blocking DNS:"
    keys=()
    while IFS='' read -r line; do keys+=("$line"); done < <(for DNS in "${!adblockDNS[@]}"; do echo "$DNS"; done | sort)
    for DNS in "${keys[@]}"; do
        printf " - %s ... " "$DNS $(echo.BoldBlack "(${adblockDNS[$DNS]})")"
        chkDomain "$domain" "${adblockDNS[$DNS]}" filterDetect
    done
}

function checkDefaultDNS() {
    defaultDNS="$(nslookup wikipedia.org | awk '/Server:/ {print $2}' | head -n 1 )"
    echo.Cyan "\nRunning nslookup over default DNS ($defaultDNS):"
    printf " - %s ... " "$defaultDNS"
    chkDomain "$domain" "$defaultDNS" filterDetect
}

function checkCustomDNS() {
    DefaultCustomDNSFile="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/CustomDNS.txt"
    if [ -z "$CustomDNSFile" ] && [ -r "$DefaultCustomDNSFile" ]; then
        CustomDNSFile="$DefaultCustomDNSFile"
    fi
    test -r "$CustomDNSFile" || return 0
    readarray -t customDNS < <(grep -v -E '^(#|$)' "$CustomDNSFile" | sed 's/#.*$//g' | grep -Eo '(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){1,3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])' | xargs -n 1)
    echo.Cyan "\nRunning nslookup over ${#customDNS[@]} custom DNS:"
    for DNS in "${customDNS[@]}"; do
        printf " - %s ... " "$DNS"
        chkDomain "$domain" "$DNS" filterDetect
    done
}

function showDomainIntel() {
    echo.Cyan "\nGet more intels about this domain from:"
    cat <<HEREDOC
AlienVault Open Threat Exchange
  - https://otx.alienvault.com/indicator/domain/$domain
Bitdefender TrafficLight
  - https://trafficlight.bitdefender.com/info/?url=https%3A%2F%2F$domain
Google Safe Browsing
  - https://transparencyreport.google.com/safe-browsing/search?url=$domain
Kaspersky Threat Intelligence Portal
  - https://opentip.kaspersky.com/$domain?tab=web
McAfee SiteAdvisor
  - https://siteadvisor.com/sitereport.html?url=$domain
Norton Safe Web
  - https://safeweb.norton.com/report/show?url=$domain
OpenDNS
  - https://domain.opendns.com/$domain
Talos Intelligence
  - https://www.talosintelligence.com/reputation_center/lookup?search=$domain
URLVoid
  - https://www.urlvoid.com/scan/$domain/
urlscan.io
  - https://urlscan.io/domain/$domain
VirusTotal
  - https://www.virustotal.com/gui/domain/$domain/detection
Whois.com
  - https://www.whois.com/whois/$domain
Yandex Site safety report
  - https://yandex.com/safety/?l10n=en&url=$domain

HEREDOC
}

echo.Cyan "You are checking domain: $domain"

warnUpDNS &
checkNofilterDNS
checkSecureDNS
checkAdblockDNS
checkDefaultDNS
checkCustomDNS
showDomainIntel