Feat/bit domain ownership pending (#3290)

Co-authored-by: ammar92 <[email protected]>
Co-authored-by: stephanie0x00 <[email protected]>
Co-authored-by: Benny <[email protected]>
Co-authored-by: noamblitz <[email protected]>

boefjes/boefjes/plugins/kat_kat_finding_types/kat_finding_types.json

@@ -489,6 +489,13 @@
     "impact": "Nonstandard headers may not be supported by all browsers and may not provide the security that is expected.",
     "recommendation": "Remove the nonstandard headers from the response."
   },
+  "KAT-DOMAIN-OWNERSHIP-PENDING": {
+    "description": "The domain requires Ownership verification. An email has been sent to the registered owner by the registrar. The domain is currently offline.",
+    "risk": "high",
+    "source": "https://www.icann.org/resources/pages/contact-verification-2013-05-03-en",
+    "impact": "Domain points to placeholder DNS-Servers, and is offline for regular use.",
+    "recommendation": "Verify ownership by following the emailed link."
+  },
   "KAT-SOFTWARE-VERSION-NOT-FOUND": {
     "description": "The version of the software is not found.",
     "risk": "recommendation",

octopoes/bits/domain_owner_verification/bit.py

@@ -0,0 +1,9 @@
+from bits.definitions import BitDefinition
+from octopoes.models.ooi.dns.records import DNSNSRecord
+
+BIT = BitDefinition(
+    id="domain-owner-verification",
+    consumes=DNSNSRecord,
+    parameters=[],
+    module="bits.domain_owner_verification.domain_owner_verification",
+)

octopoes/bits/domain_owner_verification/domain_owner_verification.py

@@ -0,0 +1,25 @@
+from collections.abc import Iterator
+
+from octopoes.models import OOI
+from octopoes.models.ooi.dns.records import DNSNSRecord
+from octopoes.models.ooi.findings import Finding, KATFindingType
+
+INDICATORS = [
+    "NS1.REGISTRANT-VERIFICATION.ISPAPI.NET",
+    "NS2.REGISTRANT-VERIFICATION.ISPAPI.NET",
+    "NS3.REGISTRANT-VERIFICATION.ISPAPI.NET",
+]
+
+
+def run(nameserver_record: DNSNSRecord, additional_oois, config: dict[str, str]) -> Iterator[OOI]:
+    """Checks to see if a domain has a specific set of dns servers which would indicate domain registrant verification.
+    https://support.dnsimple.com/articles/icann-domain-validation/
+    """
+    if nameserver_record.name_server_hostname.tokenized.name.rstrip(".").upper() in INDICATORS:
+        finding_type = KATFindingType(id="KAT-DOMAIN-OWNERSHIP-PENDING")
+        yield finding_type
+        yield Finding(
+            finding_type=finding_type.reference,
+            ooi=nameserver_record.hostname,
+            description="This domain requires ownership verification and is currently pending.",
+        )

octopoes/tests/test_bit_domain_verification.py

@@ -0,0 +1,25 @@
+from bits.domain_owner_verification.domain_owner_verification import run
+
+from octopoes.models.ooi.dns.records import DNSNSRecord
+from octopoes.models.ooi.dns.zone import Hostname
+from octopoes.models.ooi.network import Network
+
+
+def test_verification_pending():
+    network = Network(name="fake")
+    hostname = Hostname(name="example.com", network=network.reference)
+    ns_hostname = Hostname(name="ns1.registrant-verification.ispapi.net", network=network.reference)
+    ns_record = DNSNSRecord(hostname=hostname.reference, name_server_hostname=ns_hostname.reference, value="x")
+    results = list(run(ns_record, [], {}))
+
+    assert len(results) == 2
+
+
+def test_no_verification_pending():
+    network = Network(name="fake")
+    hostname = Hostname(name="example.com", network=network.reference)
+    ns_hostname = Hostname(name="ns1.example.com", network=network.reference)
+    ns_record = DNSNSRecord(hostname=hostname.reference, name_server_hostname=ns_hostname.reference, value="x")
+    results = list(run(ns_record, [], {}))
+
+    assert len(results) == 0