Ipam Dns Audit

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:15 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent IPAM/DNS audit guide, but it is marked read-only while giving unsafe remediation and credential-handling examples that deserve review before installation.

Install only if you will treat it as an audit/reporting reference, not as authority for automatic remediation. Use least-privileged read-only accounts, avoid putting tokens or passwords directly on command lines, do not use curl -k except in a controlled test case, and require normal change-management approval before deleting DNS records or disabling network ports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/cli-reference.md:206

Finding

Infoblox API Examples Disable TLS Verification and Expose Credentials in Command Arguments

Content

View full analysis

Vulnerability Details

File Location: references/cli-reference.md, lines 206–223
Vulnerability Type: Insecure TLS configuration and credential handling
Risk Level: High

Vulnerable Code

bash

# List networks in a view
curl -s -k -u "<user>:<pass>" \
  "https://<infoblox>/wapi/v2.12/network?network_view=default&_return_fields=network,comment,extattrs"

# List host records
curl -s -k -u "<user>:<pass>" \
  "https://<infoblox>/wapi/v2.12/record:host?zone=example.com&_return_fields=name,ipv4addrs"

# List A records
curl -s -k -u "<user>:<pass>" \
  "https://<infoblox>/wapi/v2.12/record:a?zone=example.com"

# Network utilization
curl -s -k -u "<user>:<pass>" \
  "https://<infoblox>/wapi/v2.12/network?network=10.1.0.0/16&_return_fields=network,utilization"

# DHCP range listing
curl -s -k -u "<user>:<pass>" \
  "https://<infoblox>/wapi/v2.12/range?network=10.1.1.0/24&_return_fields=start_addr,end_addr"

Technical Analysis

Every documented Infoblox WAPI example uses curl -k, which disables validation of the server's TLS certificate. HTTPS encryption without certificate verification does not authenticate the endpoint. An attacker capable of intercepting or redirecting network traffic can therefore present an arbitrary certificate, impersonate the Infoblox server, and terminate the TLS session without triggering a certificate error.

The same commands pass Basic Authentication credentials through the -u "<user>:<pass>" command-line argument. Those credentials are sent to whichever endpoint completes the unverified TLS connection. Depending on the operating system and execution environment, credentials embedded in arguments may also be disclosed through shell history, process inspection, terminal logs, automation logs, or audit telemetry.

Attack Path

1. An authori ...[truncated 1849 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -k from every Infoblox WAPI example and require normal certificate and hostname validation.
2. Configure Infoblox with a certificate issued by an organizational or publicly trusted CA.
3. Where a private CA is required, provide its trust chain through the system trust store or an explicit option such as:

   bash

   curl --cacert /secure/path/organization-ca.pem \
     --user "$INFOBLOX_USER" \
     "https://infoblox.example.com/wapi/v2.12/network"
   

4. Do not place literal passwords directly in command arguments. Use a protected credential file, a secret manager, or an interactive prompt. Ensure any credential file is owned by the operator and has restrictive permissions such as 0600.
5. Avoid storing secrets in shell history, scripts, CI logs, command transcripts, or report artifacts. Disable shell tracing around authentication operations.
6. Use a dedicated, least-privileged, read-only WAPI service account restricted to the precise networks, zones, and record types required by the audit.
7. Rotate any credentials previously used with these insecure examples if interception or local disclosure is plausible.
8. Fail closed on certificate errors and document certificate provisioning as a prerequisite rather than recommending TLS verification bypasses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

w ip arp vrf <name>`.

**DHCP Lease Correlation** — Extract active leases from the DHCP
server. Compare against IPAM DHCP scope definitions to ensure
boundaries match. Identify leases outside defined scopes — these
indicate misconfigured or rogue DHCP servers.

**Ping Sweep Validation** — For subnets where ARP data is incomplete
(routed subnets with no local L3 interface), use ICMP sweeps:
`nmap -sn <prefix>` or `fping -g <prefix>`. Non-responding IPs are
not necessarily unused — firewalls may block ICMP.

**Duplicate IP Detection** — Analyze ARP tables for multiple MAC
addresses on the same IP (gratuitous ARP conflicts). Rapidly
alternating MACs for a single IP indicate active conflicts causing
intermittent connectivity.

### Step 3: DNS Record Audit

Audit DNS records for consistency, accuracy, and hygiene. DNS errors
cause application failures often misdiagnosed as network issues.

**Forward/Reverse Consistency** — For each A record, verify a
corresponding PTR record poi

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/cli-reference.md (reported line 164)May include surrounding context.

md

w ip arp vrf <name>`.

**DHCP Lease Correlation** — Extract active leases from the DHCP
server. Compare against IPAM DHCP scope definitions to ensure
boundaries match. Identify leases outside defined scopes — these
indicate misconfigured or rogue DHCP servers.

**Ping Sweep Validation** — For subnets where ARP data is incomplete
(routed subnets with no local L3 interface), use ICMP sweeps:
`nmap -sn <prefix>` or `fping -g <prefix>`. Non-responding IPs are
not necessarily unused — firewalls may block ICMP.

**Duplicate IP Detection** — Analyze ARP tables for multiple MAC
addresses on the same IP (gratuitous ARP conflicts). Rapidly
alternating MACs for a single IP indicate active conflicts causing
intermittent connectivity.

### Step 3: DNS Record Audit

Audit DNS records for consistency, accuracy, and hygiene. DNS errors
cause application failures often misdiagnosed as network issues.

**Forward/Reverse Consistency** — For each A record, verify a
corresponding PTR record poi

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly labeled read-only, but its decision tree includes direct destructive remediation instructions like deleting DNS records. That mismatch can cause an agent or operator to move from audit into modification without an explicit authorization boundary, increasing the chance of unintended outages or unauthorized changes.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 182)May include surrounding context.

bash

# List prefixes in a VRF
curl -s -H "Authorization: Token <token>" \
  "https://<netbox>/api/ipam/prefixes/?vrf_id=<id>&limit=1000"

# List IP addresses in a prefix

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The deletion guidance lacks safeguards such as ownership verification, dependency checks, backup/rollback steps, approval requirements, and hold periods tied to authoritative validation. In DNS, deleting apparently stale A/PTR/CNAME records can break applications, mail flow, logging, service discovery, or reverse-DNS-dependent controls if the audit data is incomplete or transiently stale.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/cli-reference.md (reported line 168)May include surrounding context.

DHCP Server (PowerShell)

powershell

Get-DhcpServerv4Scope | Select-Object ScopeId, SubnetMask, State
Get-DhcpServerv4ScopeStatistics | Select-Object ScopeId, Free, InUse, PercentageInUse
Get-DhcpServerv4Lease -ScopeId 10.1.1.0

Subnet Discovery Tools

bash

# Ping sweep — identify active hosts
nmap -sn 10.1.1.0/24
fping -g 10.1.1.0/24 -a 2>/dev/null

# ARP scan (local subnet only)
arp-scan --localnet
arp-scan 10.1.1.0/24

# Subnet calculator
ipcalc 10.1.1.0/24
sipcalc 10.1.1.0/24

IPAM API Patterns

NetBox IPAM Module

bash

# List prefixes in a VRF
curl -s -H "Authorization: Token <token>" \
  "https://<netbox>/api/ipam/prefixes/?vrf_id=<id>&limit=1000"

# List IP addresses in a prefix
curl -s -H "Authorization: Token <token>" \
  "https://<netbox>/api/ipam/ip-addresses/?parent=<prefix>&limit=1000"

# List VLANs
curl -s -H "Authorization: Token <token>" \
  "https://<netbox>/api/ipam/vlans/?site_id=<id>"

# Prefix utilization (built-in)
curl -s -H "Authori

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes curl examples using NetBox tokens, Infoblox username/password credentials, and BlueCat bearer tokens. The reference does not include any warning about protecting secrets, avoiding shell history exposure, or using secure credential handling, even though the examples demonstrate sensitive authentication material in command lines.

Content

No source excerpt is available for this finding.