bitsquatting.pl

#!/usr/bin/perl
use strict;

my $domain = $ARGV[0];
my @letters = split("", $domain);

sub bin2dec {
    return unpack("N", pack("B32", substr("0" x 32 . shift, -32)));
}

for(my $pos = 0; $pos < scalar(@letters); $pos++)
{
        my $letter = $letters[$pos];
        print "[$letter]\n";
        my $letterBit = sprintf("0%b", ord($letter));
        for(my $i = 0; $i<8; $i++)
        {
                my $bit = substr($letterBit, $i, 1);
                my $bit = sprintf("%b", not $bit);
                my $newLetterBit;
                $newLetterBit .= ($i != 0) ? substr($letterBit, 0, $i)    : "";
                $newLetterBit .= "$bit";
                $newLetterBit .= ($i != 8) ? substr($letterBit, $i+1, 7-$i) : "";
                my $newDecimal   = bin2dec($newLetterBit);
                my $newLetter    = chr($newDecimal);
                my $description = "flip bit $i of $pos letter : $letter ($letterBit) -> $newLetter ($newLetterBit)";
                next if($newLetter !~ /[a-zA-Z\-.]/);
                my $name;
                for(my $j = 0; $j < scalar(@letters); $j++)
                {
                        if($j != $pos)
                        {
                                $name .= substr($domain, $j, 1);
                        }
                        else
                        {
                                $name .= $newLetter;
                        }
                }
                print "$name    ";
                my $domainRegex = $domain;
                $domainRegex =~ s/\./\\./g;
                if($name =~ /^${domainRegex}$/i)
                {
                        print "Just different case\n";
                        next;
                }
                my $ns= ` dig  NS "$name" `;
                if($ns =~ /NXDOMAIN/)
                {
                        print "Free ? : $description";
                }
                elsif($ns =~ /\d+\s+IN\s+NS\s+(\S+)/)
                {
                        print "NS : $1";
                }
                elsif($ns =~ /(SERVFAIL|NOERROR)/)
                {
                        print "$1";
                }
                else
                {
                        print "NS not found:$ns\n";
                }
                print "\n";
        }
}