netanelcyber / netanelcyber/AdPentestAI-Python
Bug Report: Handle DNS timeout gracefully in subnet discovery
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5
- Forks
- 2
- Avg merge
- 22h 25m
- Merged PRs (30d)
- 7
Description
Bug Report: DNS Timeout Handling
Description
DNS timeout errors during subnet discovery can crash or hang the scan unexpectedly.
Current Behavior
When DNS servers are unreachable or slow during DC subnet discovery:
- Scan hangs indefinitely
- No graceful fallback to next strategy
- User has to manually kill the process (Ctrl+C)
Expected Behavior
- Timeout after configured timeout value
- Log warning message
- Fallback to next detection strategy (LDAP, port fingerprint)
- Continue scan without interruption
Reproduction Steps
# Simulate with invalid DNS server
adpentest --target 10.0.0.1 \
--mode dry-run \
--scope-confirmed \
--dns-server 192.0.2.1 \
--dns-timeout 5.0
Expected Output
[WARNING] DNS timeout during SRV query for _ldap._tcp.dc._msdcs.domain.local
[*] Falling back to LDAP RootDSE probe...
[*] Falling back to port fingerprinting...
Technical Details
- Affected Code:
detect_dcs()incore.py(lines ~2500-3200) - Root Cause: No timeout exception handling in DNS SRV queries
- Impact: Critical - can hang indefinitely
Fix Approach
try:
results = dns.resolver.resolve(qname, rdtype)
# process results
except dns.exception.Timeout:
print(f"[WARNING] DNS timeout for {qname}", file=sys.stderr)
# Fallback to next strategy
except dns.exception.DNSException as e:
print(f"[WARNING] DNS error: {e}", file=sys.stderr)
# Fallback to next strategy
Acceptance Criteria
- All DNS operations have timeout handling
- Clear warning messages on timeout
- Fallback to next DC detection method
- No indefinite hangs
- Documentation updated
Priority
High - affects usability in environments with poor DNS connectivity
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in core.py at detect_dcs() around lines 2500-3200 and reproduce with the provided adpentest command using an unreachable DNS server. Trace all DNS SRV operations and the existing DC detection strategies, then verify timeout warnings, fallback through LDAP and port fingerprinting, continued scanning, and updated documentation against the acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100