rsdga

README

RSDGA

Really Simple Domain Generation Algorithm

Short and to the point Go library for generating domain names based on supplied parameters. A Domain Generation Algorithm is used to circumvent general domain blocklists by generating seemingly random domain names (In this case: using the current date along with an optional seed, hashed with MD5). A better description and overview can be found here.

Written for the Hands-on Writing Malware in Go talk at BSidesDC 2019.

For legal use only.

Usage - Go Playground

Pretty simple (One might say really simple):

import (
	"fmt"
	"time"

	"github.com/cs-5/rsdga"
)

func main() {
	t := time.Now()

	/* Use the current time to supply the year, month, and day. Use ".com" as the TLD */
	gen := rsdga.New(t.Year(), int(t.Month()), t.Day(), "com")

	/* Print out 5 domains */
	for i := 0; i < 5; i++ {
		fmt.Println(gen.Next())
	}
}

Output:

7cf3c19ef5871a8bdca3288bac26f615.com
813ed870de75f3605f7d4b2a0fe93608.com
6d06004feb188a4a463affbdbfff51d3.com
e285c151730d8a5ec59369d609df3e07.com
bec43b55c54522cfa12eaaef55c6f460.com

Make a new Generator

Without a seed: generator := rsdga.New(2019, 01, 01, "com")

With a seed: generator := rsdga.NewSeeded(2019, 01, 01, 1234, "com")

Get Domain

domain := generator.Next()

Documentation

Overview

Package rsdga (Really Simple Domain Generation Algorithm) is used to generate domain names based on the supplied date (year, month, day) and an optional seed. MD5 is used to hash the value of the supplied parameters and is returned with the supplied TLD appended.

DGA

Domain Genereration Algorithms are used to circumvent general domain blocklists by generating seemingly random domain names (In this case: using the current date along with an optional seed, hashed with MD5).

Usage

Basic code to initialize the generator and print the domains:

import (
	"fmt"
	"time"

	"github.com/cs-5/rsdga"
)

func main() {
	t := time.Now()

	/* Use the current time to supply the year, month, day, and seed. Use ".com" as the TLD */
	gen := rsdga.New(t.Year(), int(t.Month()), t.Day(), "com")

	/* Print out 5 domains */
	for i := 0; i < 5; i++ {
		fmt.Println(gen.Next())
	}
}

Example output:

7cf3c19ef5871a8bdca3288bac26f615.com
813ed870de75f3605f7d4b2a0fe93608.com
6d06004feb188a4a463affbdbfff51d3.com
e285c151730d8a5ec59369d609df3e07.com
bec43b55c54522cfa12eaaef55c6f460.com

Index

• type Generator
  • func New(year, month, day int, tld string) *Generator
  • func NewSeeded(year, month, day, seed int, tld string) *Generator
  • func (g *Generator) Next() string

Examples

• Generator
• Generator (Seeded)

Types

type Generator

type Generator struct {
	// contains filtered or unexported fields
}

Generator contains the parameters required to generate domains. Use New() or NewSeeded() to initialize.

Example

package main

import (
	"fmt"
	"time"

	"github.com/CS-5/rsdga"
)

func main() {
	t := time.Now()

	/* Use the current time to supply the year, month, day, and seed. Use ".com" as the TLD */
	gen := rsdga.New(t.Year(), int(t.Month()), t.Day(), ".com")

	/* Print out 5 domains */
	for i := 0; i < 5; i++ {
		fmt.Println(gen.Next())
	}
}

Example (Seeded)

package main

import (
	"fmt"
	"time"

	"github.com/CS-5/rsdga"
)

func main() {
	t := time.Now()

	/* Use the current time to supply the year, month, day, and 1234 as the seed. Use ".com" as the TLD */
	gen := rsdga.NewSeeded(t.Year(), int(t.Month()), t.Day(), 1234, ".com")

	/* Print out 5 domains */
	for i := 0; i < 5; i++ {
		fmt.Println(gen.Next())
	}
}

func New

func New(year, month, day int, tld string) *Generator

New initializes a new Generator and returns it. Year, month, and day must all be in YYYY, MM, DD format (respectively). Note: There is no input validation here.

func NewSeeded

func NewSeeded(year, month, day, seed int, tld string) *Generator

NewSeeded initializes a new Generator with a seed and returns it. See New() for parameter descriptions.

func (*Generator) Next

func (g *Generator) Next() string

Next returns the generated domain as a string and increments the iterator MD5 is used to hash the generated string before adding the TLD and returning.