morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3599] [Feature] Passive DNS extraction and cybersecurity analysis primitives for binary reverse engineering #1336

New issue

Open

opened 2026-10-16 21:04:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:26 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3599

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I understand the contribution scope must be reviewed before integration; open questions are welcome here.
This request does not include credentials, private samples, or sensitive target data.

Area

Evidence, artifacts, or reconstruction

Current limitation

Analyst question: "My inspected binary or application communicated with external hosts during a recorded PCAP run. Which domain names were queried, what IP addresses and CNAME chains did DNS resolve to, and does the binary exhibit high-entropy encrypted payload sections or identifiable TLS fingerprints?"

Currently, REA provides:

inspect_web_network_capture for HTTP-level archives (HAR, SAZ, mitmproxy, qlog);
inspect_packet_capture (#2318) for general TShark packet queries; and
Native format headers for PE/Mach-O/ELF.

However, there is no dedicated, bounded primitive for extracting and correlating DNS transaction intelligence (queries, response records, DGA-like entropy, NXDOMAIN patterns) or cybersecurity triage indicators (section-level Shannon entropy, TLS ClientHello JA3/JA4 fingerprints, and embedded certificate pinning data) into structured Evidence.

Use cases

Malware and Incident Investigation: Extracting passive DNS records from sandbox PCAP captures to discover Command-and-Control (C2) domains, fast-flux networks, and DGA (Domain Generation Algorithm) patterns without active network scanning.
Telemetry & Endpoint Auditing: Discovering hardcoded backend endpoints, dynamic resolution fallbacks, and DNS-over-HTTPS (DoH) server targets embedded in proprietary applications.
Packed / Encrypted Binary Triage: Calculating sliding-window Shannon entropy across sections/segments (PE sections, Mach-O segments, ELF PT_LOAD) to pinpoint packed or encrypted payloads before running expensive decompiler passes.
TLS Fingerprinting: Auditing TLS ClientHello characteristics (SNI, cipher suite preference order, extensions, JA3/JA4 hashes) from captured flows to identify the underlying networking library (e.g. WinINet, cURL, Go HTTP, custom raw sockets).

Desired outcome and success criteria

DNS Extraction (inspect_dns_capture / dns_resolution_view):

Accepts a local PCAP/PCAPNG capture file.
Parses offline DNS (UDP/TCP 53 and mDNS 5353) transactions: Query Name, Record Type (A, AAAA, CNAME, TXT, SRV, PTR), Resolved Answers, TTL, and Response Status (NOERROR, NXDOMAIN, SERVFAIL).
Output record shape example:

{
  "dns_transactions": [
    {
      "frame": 12,
      "timestamp": "2026-10-14T12:00:01.120Z",
      "query": "api.internal-telemetry.com",
      "qtype": "A",
      "rcode": "NOERROR",
      "answers": [
        { "type": "CNAME", "data": "edge.cdn-routing.net" },
        { "type": "A", "data": "198.51.100.42", "ttl": 300 }
      ]
    }
  ],
  "summary": {
    "unique_queries": 1,
    "unique_resolved_ips": ["198.51.100.42"],
    "nxdomain_queries": []
  }
}

Section Shannon Entropy (inspect_binary_entropy):
- Calculates byte-level entropy (0.0 \le H \le 8.0) for named binary sections (e.g. .text, .data, .rsrc, __TEXT, __const).
- Flags sections where H \ge 7.2 as probable compressed or encrypted payloads with explicit uncertainty semantics.
TLS ClientHello Fingerprinting:
- Surfaces extracted SNI, ALPN, and JA3/JA4 strings alongside packet capture facts without contacting live hosts.

Expected interaction with targets

Read existing files or captured data
No target interaction (documentation or usability only)

Target and scope details (optional)

Strictly Offline: All analysis operates offline on caller-provided files (PCAP, PCAPNG, binaries). REA must never initiate live DNS lookups, whois queries, or external threat-intelligence lookups.
Containment & Privacy: Transport credentials, secrets, and private internal DNS names remain local; no external service telemetry is contacted.

Alternatives considered

Manual Wireshark / TShark filters: Requires custom scripting outside REA's reproducible Evidence model.
Running strings + grep: Misses binary DNS packet structures, CNAME chains, and sliding-window entropy distributions.

Possible direction

Integrate a lightweight offline DNS packet parser (utilizing existing PCAP stream infrastructure or bounded TShark field selectors for dns.qry.name, dns.a, dns.cname, dns.flags.rcode).
Implement pure-function Shannon entropy calculation in src/domain/binary/ to evaluate byte arrays directly.

References

Passive DNS Architecture: RFC 8499 (DNS Terminology), RFC 1035
JA3 / JA4 TLS Fingerprinting specifications
Existing REA packet capture infrastructure: #2318, #3115, #3594, docs/packet-captures.md

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3599 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I understand the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope) must be reviewed before integration; open questions are welcome here. - [x] This request does not include credentials, private samples, or sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Current limitation Analyst question: *"My inspected binary or application communicated with external hosts during a recorded PCAP run. Which domain names were queried, what IP addresses and CNAME chains did DNS resolve to, and does the binary exhibit high-entropy encrypted payload sections or identifiable TLS fingerprints?"* Currently, REA provides: - `inspect_web_network_capture` for HTTP-level archives (HAR, SAZ, mitmproxy, qlog); - `inspect_packet_capture` (#2318) for general TShark packet queries; and - Native format headers for PE/Mach-O/ELF. However, there is no dedicated, bounded primitive for extracting and correlating **DNS transaction intelligence** (queries, response records, DGA-like entropy, NXDOMAIN patterns) or **cybersecurity triage indicators** (section-level Shannon entropy, TLS ClientHello JA3/JA4 fingerprints, and embedded certificate pinning data) into structured Evidence. ### Use cases 1. **Malware and Incident Investigation**: Extracting passive DNS records from sandbox PCAP captures to discover Command-and-Control (C2) domains, fast-flux networks, and DGA (Domain Generation Algorithm) patterns without active network scanning. 2. **Telemetry & Endpoint Auditing**: Discovering hardcoded backend endpoints, dynamic resolution fallbacks, and DNS-over-HTTPS (DoH) server targets embedded in proprietary applications. 3. **Packed / Encrypted Binary Triage**: Calculating sliding-window Shannon entropy across sections/segments (PE sections, Mach-O segments, ELF PT_LOAD) to pinpoint packed or encrypted payloads before running expensive decompiler passes. 4. **TLS Fingerprinting**: Auditing TLS ClientHello characteristics (SNI, cipher suite preference order, extensions, JA3/JA4 hashes) from captured flows to identify the underlying networking library (e.g. WinINet, cURL, Go HTTP, custom raw sockets). ### Desired outcome and success criteria 1. **DNS Extraction (`inspect_dns_capture` / `dns_resolution_view`)**: - Accepts a local PCAP/PCAPNG capture file. - Parses offline DNS (UDP/TCP 53 and mDNS 5353) transactions: Query Name, Record Type (A, AAAA, CNAME, TXT, SRV, PTR), Resolved Answers, TTL, and Response Status (NOERROR, NXDOMAIN, SERVFAIL). - Output record shape example: ```json { "dns_transactions": [ { "frame": 12, "timestamp": "2026-10-14T12:00:01.120Z", "query": "api.internal-telemetry.com", "qtype": "A", "rcode": "NOERROR", "answers": [ { "type": "CNAME", "data": "edge.cdn-routing.net" }, { "type": "A", "data": "198.51.100.42", "ttl": 300 } ] } ], "summary": { "unique_queries": 1, "unique_resolved_ips": ["198.51.100.42"], "nxdomain_queries": [] } } ``` 2. **Section Shannon Entropy (`inspect_binary_entropy`)**: - Calculates byte-level entropy ($0.0 \le H \le 8.0$) for named binary sections (e.g. `.text`, `.data`, `.rsrc`, `__TEXT`, `__const`). - Flags sections where $H \ge 7.2$ as probable compressed or encrypted payloads with explicit uncertainty semantics. 3. **TLS ClientHello Fingerprinting**: - Surfaces extracted SNI, ALPN, and JA3/JA4 strings alongside packet capture facts without contacting live hosts. ### Expected interaction with targets - Read existing files or captured data - No target interaction (documentation or usability only) ### Target and scope details (optional) - **Strictly Offline**: All analysis operates offline on caller-provided files (PCAP, PCAPNG, binaries). REA must never initiate live DNS lookups, whois queries, or external threat-intelligence lookups. - **Containment & Privacy**: Transport credentials, secrets, and private internal DNS names remain local; no external service telemetry is contacted. ### Alternatives considered - Manual Wireshark / TShark filters: Requires custom scripting outside REA's reproducible Evidence model. - Running strings + grep: Misses binary DNS packet structures, CNAME chains, and sliding-window entropy distributions. ### Possible direction - Integrate a lightweight offline DNS packet parser (utilizing existing PCAP stream infrastructure or bounded TShark field selectors for `dns.qry.name`, `dns.a`, `dns.cname`, `dns.flags.rcode`). - Implement pure-function Shannon entropy calculation in `src/domain/binary/` to evaluate byte arrays directly. ### References - Passive DNS Architecture: RFC 8499 (DNS Terminology), RFC 1035 - JA3 / JA4 TLS Fingerprinting specifications - Existing REA packet capture infrastructure: #2318, #3115, #3594, `docs/packet-captures.md`

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1336

No description provided.

Rows
Columns