[liquidsec]

Replaces massdns with blastdns 2.0 for DNS brute-forcing, and drops the massdns dependency entirely.

Changes

• Brute-force DNS through blastdns instead of massdns; massdns dependency and references removed
• Brute-force gets its own retry budget, a short per-query timeout, and persistent sockets (one per resolver rather than one per in-flight query)
• New --custom-nameservers flag, replacing the system resolvers for normal resolution
• Resolver diagnostics reported when brute-force delivery drops
• The DNS helper is now built during scan prep. Previously an invalid dns.nameservers value surfaced as a per-event error inside dnsresolve after setup had already reported success, so a typo produced a green "completed" scan with zero results instead of an abort.

baddns 2.5.0

2.5.0 is the release that widened baddns's blastdns pin, so the temporary [tool.uv] override-dependencies block is gone. BBOT now requires baddns~=2.5.0 and caps blastdns at <2.1 to match baddns's own ceiling, so a future blastdns 2.1 cannot silently break module dependency installs the way <1.10 did.

Adapting to what 2.5.0 changed:

• NS gained a lame-delegation finding, raising its ceiling to HIGH/CONFIRMED in SUBMODULE_MAX_SEVERITY and SUBMODULE_MAX_CONFIDENCE
• The new DELEGATION submodule is added to both tables at HIGH/CONFIRMED
• The bigcartel signature the test fixture relied on was dropped upstream, so the fixture now matches the surviving nuclei signature (409 plus error code: 1001)
• The aws-bucket signature was rescoped to require an amazonaws.com subject. Direct mode uses the target as the subject, so that cannot be satisfied against a localhost test server; the baddns_direct fixture now uses a signature with no CNAME identifier, which is the class a Cloudflare-fronted host actually hits. Real STORAGE_BUCKET detection is unaffected, since those hosts genuinely contain amazonaws.com.

Behavior changes

DELEGATION is enabled by default, both in the module's default submodule list and in the baddns and baddns-heavy presets. It checks _acme-challenge, _dmarc and 15 common DKIM selector labels for dangling delegations and reports at HIGH severity. Two filters keep the volume down: a wildcard CNAME probe per depth drops labels that only resolve because of a wildcard, and generic findings (a CNAME to a name that merely does not exist, which is routine for DKIM selector pairs) are discarded, leaving only claimable outcomes.

baddns's WordMatcher is now passed through. It compiles every signature's word matchers into one YARA ruleset at setup and matches a response against all of them in a single pass, instead of evaluating each signature's words in turn per response. This is what baddns 2.5.0's new yara-python dependency is for, and baddns's own CLI already does it. It is a cache with the previous path as fallback, and was checked for equivalence against that path across 2,044 signature/response pairs with no divergence.

New DELEGATION module tests cover the three label kinds, wildcard suppression, and the generic-finding filter.

docs/scanning/advanced.md is deliberately not regenerated here. It embeds bbot --help, which CI generates on a newer Python whose argparse formats help text differently, so the daily docs job will pick up --custom-nameservers.

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs blastdns-2.0 (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	3.23ms	2.96ms	-8.1% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	13.44ms	11.75ms	-12.6% 🟢🟢	🚀
Large Closest Match Lookup	254.18ms	262.34ms	+3.2% ⚪	✅
Realistic Closest Match Workload	139.78ms	137.32ms	-1.8% ⚪	✅
Event Memory Medium Scan	1402 B/event	1403 B/event	+0.1% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	324.67ms	323.10ms	-0.5% ⚪	✅
Event Validation Full Scan Startup Large Batch	413.29ms	412.43ms	-0.2% ⚪	✅
Make Event Autodetection Small	16.16ms	16.09ms	-0.4% ⚪	✅
Make Event Autodetection Large	164.31ms	160.24ms	-2.5% ⚪	✅
Make Event Explicit Types	6.78ms	6.61ms	-2.6% ⚪	✅
Excavate Single Thread Small	3.295s	3.000s	-8.9% ⚪	✅
Excavate Single Thread Large	7.818s	7.573s	-3.1% ⚪	✅
Excavate Parallel Tasks Small	3.477s	3.373s	-3.0% ⚪	✅
Excavate Parallel Tasks Large	5.132s	4.956s	-3.4% ⚪	✅
Intercept Throughput Small	789.61ms	795.68ms	+0.8% ⚪	✅
Intercept Throughput Medium	779.77ms	780.49ms	+0.1% ⚪	✅
Dns Throughput Quiet	2.023s	2.023s	+0.0% ⚪	✅
Dns Throughput Loaded	1.383s	1.369s	-1.0% ⚪	✅
Dns Throughput Inherited	1.720s	1.754s	+2.0% ⚪	✅
Is Ip Performance	1.74ms	1.74ms	-0.2% ⚪	✅
Make Ip Type Performance	159.35µs	160.64µs	+0.8% ⚪	✅
Mixed Ip Operations	1.80ms	1.84ms	+1.8% ⚪	✅
Memory Use Web Crawl	1.2 MB	1.1 MB	-3.4% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.1 MB	+0.4% ⚪	✅
Memory Use Parallel Chains	13.4 MB	12.5 MB	-6.7% ⚪	✅
Scan Throughput 100	2.263s	2.149s	-5.0% ⚪	✅
Scan Throughput 1000	14.022s	13.955s	-0.5% ⚪	✅
Typical Queue Shuffle	4.17µs	4.19µs	+0.5% ⚪	✅
Priority Queue Shuffle	21.74µs	20.99µs	-3.5% ⚪	✅

🎯 Performance Summary

+ 1 improvement 🚀
  30 unchanged ✅

🔍 Significant Changes (>10%)

• Bloom Filter Large Scale Dns Brute Force: 12.6% 🚀 faster

---

🐍 Python Version 3.11.17

[codecov]

Codecov Report

❌ Patch coverage is 96.01770% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 91%. Comparing base (4e4c3b7) to head (67424f1).
⚠️ Report is 2 commits behind head on dev.

Files with missing lines	Patch %	Lines
bbot/core/helpers/dns/brute.py	80%	14 Missing ⚠️
bbot/test/test_step_1/test_dns.py	99%	4 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##             dev   #3457    +/-   ##
======================================
+ Coverage     91%     91%    +1%     
======================================
  Files        463     463            
  Lines      50142   50459   +317     
======================================
+ Hits       45255   45573   +318     
+ Misses      4887    4886     -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[en0f]

Blocker: the PR can’t merge into dev because of conflicts. GitHub reports it as not mergeable, and no CI checks have run on the latest commit (73eb9b1), so CI hasn’t tested it yet. Two files conflict:

pyproject.toml: the PR raises blastdns to >=2.0.1,<2.1 and baddns to ~=2.5.0. Meanwhile dev raised pycryptodome to <5, fastapi to <0.144.0 and ruff to 0.17.0, and added a [tool.uv] section that sets a minimum virtualenv version. The fix is to keep both sides’ changes.
uv.lock: regenerate it with uv lock once pyproject.toml is fixed.

[liquidsec]

Blocker: the PR can’t merge into dev because of conflicts. GitHub reports it as not mergeable, and no CI checks have run on the latest commit (73eb9b1), so CI hasn’t tested it yet. Two files conflict:

pyproject.toml: the PR raises blastdns to >=2.0.1,<2.1 and baddns to ~=2.5.0. Meanwhile dev raised pycryptodome to <5, fastapi to <0.144.0 and ruff to 0.17.0, and added a [tool.uv] section that sets a minimum virtualenv version. The fix is to keep both sides’ changes. uv.lock: regenerate it with uv lock once pyproject.toml is fixed.

We're in a holding pattern here anyway until #3474 merges, which now targets this branch. At that time we will sync up all of the dependencies.

[singlerider]

🟢 Clean massdns removal, conflicts from prior review resolved, brute client mocked so tests stay offline.

[liquidsec]

Resolved in d4b2e68 (merged dev into this branch). pyproject.toml keeps both sides: dev's pycryptodome, fastapi, ruff and virtualenv changes, plus this PR's blastdns and baddns versions. uv.lock has been regenerated and matches. CI passes on 67424f1. Could you re-review?