{"id":2940,"date":"2010-09-01T09:40:54","date_gmt":"2010-09-01T08:40:54","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2940"},"modified":"2010-09-01T09:40:54","modified_gmt":"2010-09-01T08:40:54","slug":"windows-powershell-dns-server-blackhole-tool-blacklist-domains","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2010\/09\/windows-powershell-dns-server-blackhole-tool-blacklist-domains\/","title":{"rendered":"Windows PowerShell DNS Server Blackhole Tool &#8211; Blacklist Domains"},"content":{"rendered":"<p>This is a Windows PowerShell Script to help you with blacklisting domains you wish to block in your networks.<\/p>\n<p>We have written about <a href=\"https:\/\/www.darknet.org.uk\/tag\/powershell\/\">PowerShell<\/a> before, it is something which can make the windows shell a lot more flexible.<\/p>\n<p>On the external DNS servers you can create primary zones for the domain names and FQDNs you do not want your users to resolve correctly.  These DNS zones will all return an incorrect IP address, such as \u201c0.0.0.0\u2033 or the address of an internal server, not the real address.  Because the organization\u2019s internal DNS servers are configured to forward their requests to these external DNS servers in the DMZ, the internal DNS servers will cache these incorrect addresses too when the external DNS servers respond.  So, when an internal client tries to resolve an unwanted DNS name, it will receive a response, but the IP address returned will be incorrect.  Because an IP address of \u201c0.0.0.0\u2033 is unreachable, these unwanted zones created on the external DNS servers are said to be \u201cblackholed\u201d, \u201cblacklisted\u201d or \u201cblocklisted\u201d.<\/p>\n<p>What to block?  You can obtain lists of FQDNs and domain names to blackhole for free.  Some lists are only for malware, others might be just for pornography, but be aware that they are never 100% complete or accurate (you get what you pay for, so don\u2019t be surprised to find gaps a small number of false positives).<\/p>\n<p>Some of the more popular blackhole lists include (in no particular order):<\/p>\n<p><a href=\"http:\/\/www.MalwareDomains.com\">www.MalwareDomains.com<\/a><br \/>\n<a href=\"http:\/\/www.Malware.com.br\">www.Malware.com.br<\/a><br \/>\n<a href=\"http:\/\/www.MalwareDomainList.com\">www.MalwareDomainList.com<\/a><br \/>\n<a href=\"http:\/\/www.MalwareURL.com\">www.MalwareURL.com<\/a><br \/>\n<a href=\"http:\/\/www.SomeoneWhoCares.org\">www.SomeoneWhoCares.org<\/a><br \/>\n<a href=\"http:\/\/mtc.sri.com\">mtc.sri.com<\/a><br \/>\n<a href=\"http:\/\/www.MVPs.org\">www.MVPs.org<\/a><br \/>\n<a href=\"http:\/\/www.UrlBlacklist.com\">www.UrlBlacklist.com<\/a> (not free)<\/p>\n<p>From sites like the above you can download lists of FQDNs and simple domain names which can be fed into the PowerShell script for this article in order to create blackhole zones on Windows DNS servers.  If you have DNS servers running BIND, perhaps on Linux or BSD, then the sites above will also help you import blackhole domains on those DNS servers too (scripts for blackholing on BIND are common).<\/p>\n<p><strong>Requirements<\/strong><\/p>\n<p>To use the PowerShell DNS blackhole script, you must:<\/p>\n<ul>\n<li>Have <a href=\"http:\/\/www.microsoft.com\/powershell\">PowerShell<\/a> 2.0 or later on the computer where the script will be run, which may be the DNS server itself or another management workstation.<\/li>\n<li>Use Windows Server 2003 with SP2 or later for the DNS server.<\/li>\n<li>Allow network access to the RPC ports of the Windows Management Instrumentation (WMI) service from the workstation where the script will be run.<\/li>\n<li>Be a member of the local Administrators group on the DNS server.<\/li>\n<\/ul>\n<p>You can download the PowerShell DNS Blackhole script here:<\/p>\n<p><a href=\"http:\/\/blogs.sans.org\/windows-security\/files\/Blackhole-DNS.zip\">Blackhole-DNS.zip<\/a><\/p>\n<p>Or read more <a href=\"http:\/\/blogs.sans.org\/windows-security\/2010\/08\/31\/windows-dns-server-blackhole-blacklist\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a Windows PowerShell Script to help you with blacklisting domains you wish to block in your networks. We have written about PowerShell before, it is something which can make the windows shell a lot more flexible. On the external DNS servers you can create primary zones for the domain names and FQDNs you [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,5,11],"tags":[2129,492],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2940"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=2940"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2940\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=2940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=2940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=2940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}