diff --git a/bbot/core/helpers/dns.py b/bbot/core/helpers/dns.py index 35cf97c8bd..6bcac62575 100644 --- a/bbot/core/helpers/dns.py +++ b/bbot/core/helpers/dns.py @@ -849,12 +849,13 @@ async def is_wildcard(self, query, ips=None, rdtype=None): # for every parent domain, starting with the shortest try: for host in parents[::-1]: + # make sure we've checked that domain for wildcards + await self.is_wildcard_domain(host) + # for every rdtype for _rdtype in list(base_query_ips): # get the IPs from above query_ips = base_query_ips.get(_rdtype, set()) - # make sure we've checked that domain for wildcards - await self.is_wildcard_domain(host) host_hash = hash(host) if host_hash in self._wildcard_cache: diff --git a/bbot/modules/massdns.py b/bbot/modules/massdns.py index ab913128d7..caf0b7fab9 100644 --- a/bbot/modules/massdns.py +++ b/bbot/modules/massdns.py @@ -115,7 +115,7 @@ async def filter_event(self, event): subdomain_depth = self.helpers.subdomain_depth(query) + 1 if subdomain_depth > self.max_depth: eligible = False - reason = f"subdomain depth of *.{event.data} ({subdomain_depth}) > max_depth ({self.max_depth})" + reason = f"subdomain depth of *.{query} ({subdomain_depth}) > max_depth ({self.max_depth})" # don't brute-force things that look like autogenerated PTRs if self.helpers.is_ptr(query): @@ -127,6 +127,7 @@ async def filter_event(self, event): # reject if already processed if self.already_processed(query): return False, f'Query "{query}" was already processed' + if eligible: self.processed.add(hash(query)) return True, reason