Here's the script. Although I ran this against a production 5520 with no peformance impact or other negative results, consider this an official "Run at Your Own Risk" warning.
1) edit the script to include your ASA hostname, IP address, and user creds.
2) create a list of domains you'd like to check in a text file called 'blocklist_to_check.txt', each domain on a separate line.
3) run the script: ./btf-check-blocklist.sh which will ssh to ASA, open the above file, and execute the 'database find' command for each blocklist entry, and save ALL of the output in a file called blocklist_result.txt.
4) Run the btf-cleanup.sh script to create a file called blocklist_result-found.txt and blocklist_result-not_found.txt
btf-check-blocklist.sh:
#!/usr/local/bin/expect
# Written by Neil Clauson
# uncomment for expect verbosity
#set verbose_flag 1
# uncomment for expect debugging
#exp_internal 1
# set global parameters
set asa_ip "192.168.1.1"
set asa_hostname "YOURASA"
set asa_username "your_username"
set asa_password "your_password"
# todo: set params via command line
#set username [lindex $argv 0]
#set password [lindex $argv 1]
proc btfcheck {infile outfile} {
global asa_hostname
set fid_in [open $infile r]
set fid_out [open $outfile w+]
# uncomment below to turn OFF screen output
log_user 0
while 1 {
if {[gets $fid_in line] == -1} break
send "dynamic-filter database find $line\r"
expect "$asa_hostname#"
set buff $expect_out(buffer);
puts $fid_out $buff
}
}
# main routine:
# SSH to ASA
spawn ssh -l $asa_username $asa_ip
expect "$asa_username@$asa_ip's password:"
send "$asa_password\r"
expect "$asa_hostname>"
send "en\r"
expect "Password:"
send "$asa_password\r"
expect "$asa_hostname#"
# parse the lists
# todo: implement cli args to pick which lists to parse
# format: btfcheck
btfcheck blocklist_to_check.txt blocklist_results.txt
# logoff ASA
send "exit\r"
--
btf-cleanup.sh:
#!/bin/sh
cat blocklist_results.txt | grep -v '#' | grep -v dynamic-filter | grep -v Found > blocklist_result-found.txt
cat blocklist_results.txt | grep -v '#' | awk '/Found 0/{where=NR;print}NR==where+1 && where!=0 {print}' | grep -v Found | cut -d " " -f 5 > blocklist_result-not_found.txt
