808 show dns fqdn ips

[kirkhauck]

Summary

This adds a new command, show-dns-fqdn-ips, which will print all the IP addresses associated with a specified FQDN. Also updates the readme to include the new command.

Needed to change the function name HostnameIPResults in pkg/hostname/results.go to IPResults to satisfy the linter.

Related Issue

closes #808

Testing

Obtain FQDN to test against

• adservice.google.com is usually a good choice as it is widely used.
• You could also obtain your own by navigating inside the directory of your Zeek logs and running zcat dns.* | nice zcutter.py query -C | sort | less -S -x 20 to view a list of FQDNs to choose from. Choose one that is used more than once.

Acquire list of IPs to compare RITA command against

1. Navigate inside the directory of your zeek logs
2. Run: zgrep adservice.google.com dns.* | cut -d$'\t' -f22 | sort | uniq | cut -d, -f2
   Alternatively, if you have zcutter installed, you can run the following command:
   zcat dns.* | nice zcutter.py query answers -C | grep adservice.google.com | sort -u | cut -d, -f2
   NOTE: replace adservice.google.com with your own FQDN if you chose to find your own to test against.
3. Save the IP addresses the command returns. These are what you will check the RITA command against.

Test show-dns-fqdn-ips

1. Navigate to your RITA dev directory
2. Make sure you have your dataset imported into RITA and your database is up and running:
   Start DB (assuming you are using MongoDB): sudo systemctl start mongod
   Import dataset: rita import <files/directory to import>
3. Run ./rita show-dns-fqdn-ips <database> <fqdn>
   (e.g. ./rita show-dns-fqdn-ips empire adservice.google.com
4. You should see the header "Resolved IP" followed by a list of all IPs associated with that FQDN. Compare to the IP addresses you recorded earlier and ensure they match.

Test flags

1. Running the command with -H should show a human-readable view with an ASCII table.
2. Running the command with -nn should show the resolved IPs along with the network name separated by a delimiter (comma if none is specified)
3. Running the command with both -H and -nn should show the table with both IPs and the network names

Test error handling

1. Running ./rita show-dns-fqdn-ips should prompt the user to specify a database
2. Running ./rita show-dns-fqdn-ips <database> should prompt the user to specify an FQDN
3. Running a valid command that yields no results should alert the user that no results were found for that database

[Zalgo2462]

The automated linter doesn't like the naming of one of the methods. Please change the name to match the suggested name:
https://github.com/activecm/rita/actions/runs/5525233242/jobs/10078587037?pr=809#step:3:197
(running make test or make docker-test should allow you to reproduce the checks on your development system).

[kirkhauck]

Thanks @Zalgo2462 ! Changed the name and it passed the tests. I updated the PR to reflect the function name change.

Thanks for the new commands!

[Zalgo2462]

One small code change to be made. Otherwise, its looking good to me.

[Zalgo2462]

Please rename this fqdn and remove line 42 since these variables are assigned the same value.

[Zalgo2462]

LGTM