> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/network-discovery/dns-enumeration.md). # DNS Enumeration ## Introduction The [*Domain Name System*](https://www.cloudflare.com/learning/dns/what-is-dns/) (DNS) is a distributed database responsible for translating user-friendly domain names into IP addresses. It's one of the most critical systems on the internet. This is facilitated by a hierarchical structure that is divided into several zones, starting with the top-level root zone. Each domain can use different types of DNS records. Some of the most common types of DNS records include: * **NS**: Nameserver records contain the name of the authoritative servers hosting the DNS records for a domain. * **A**: Also known as a host record, the "*a record*" contains the IPv4 address of a hostname (such as [www.megacorpone.com](http://www.megacorpone.com)). * **AAAA**: Also known as a quad A host record, the "*aaaa record*" contains the IPv6 address of a hostname (such as [www.megacorpone.com](http://www.megacorpone.com)). * **MX**: Mail Exchange records contain the names of the servers responsible for handling email for the domain. A domain can contain multiple MX records. * **PTR**: Pointer Records are used in reverse lookup zones and can find the records associated with an IP address. * **CNAME**: Canonical Name Records are used to create aliases for other host records. * **TXT**: Text records can contain any arbitrary data and be used for various purposes, such as domain ownership verification. Due to the wealth of information contained within DNS, it is often a lucrative target for active information gathering. ## Manual Enumeration ### Enumeration with dig #### Finding IP-addresses of sites Using the **dig** command to find the IP address of **[www.megacorpone.com](http://www.megacorpone.com)** ```bash dig www.megacorpone.com ``` #### Querying specific DNS records Querying a specific DNS record with dig, in this case `TXT`records ```bash dig -t txt megacorpone.com ``` #### Querying for all DNS records ```bash dig -t any www.megacorpone.com ``` ### Enumeration with host #### Finding hosts of a domain First, let's build a list of possible hostnames: ```bash kali@kali:~$ cat hosts.txt www ftp mail owa proxy router ``` Next, we can use a Bash one-liner to attempt to resolve each hostname. ```bash kali@kali:~$ for ip in $(cat hosts.txt); do host $ip.megacorpone.com; done www.megacorpone.com has address 149.56.244.87 Host ftp.megacorpone.com not found: 3(NXDOMAIN) mail.megacorpone.com has address 51.222.169.212 Host owa.megacorpone.com not found: 3(NXDOMAIN) Host proxy.megacorpone.com not found: 3(NXDOMAIN) router.megacorpone.com has address 51.222.169.214 ``` #### Finding IP-addresses of sites Using the **host** command to find the IP address of **[www.megacorpone.com](http://www.megacorpone.com)** ```bash host www.megacorpone.com ``` #### Finding mail-servers of a domain Querying for `MX` records with host ```bash host -t mx megacorpone.com ``` #### Querying specific DNS records Querying a specific DNS record with host, in this case `TXT`records ```bash host -t txt megacorpone.com ``` Querying for `NS` records ```bash host -t ns offseclab.io ``` #### Reverse DNS-lookups Let's use a loop to reverse lookup IP addresses 51.222.169.200 through 51.222.169.254. We will filter out invalid results (using `grep -v`), showing only entries that do not contain "not found". ```bash kali@kali:~$ for ip in $(seq 200 254); do host 51.222.169.$ip; done | grep -v "not found" ... 208.169.222.51.in-addr.arpa domain name pointer admin.megacorpone.com. 209.169.222.51.in-addr.arpa domain name pointer beta.megacorpone.com. 210.169.222.51.in-addr.arpa domain name pointer fs1.megacorpone.com. 211.169.222.51.in-addr.arpa domain name pointer intranet.megacorpone.com. 212.169.222.51.in-addr.arpa domain name pointer mail.megacorpone.com. 213.169.222.51.in-addr.arpa domain name pointer mail2.megacorpone.com. 214.169.222.51.in-addr.arpa domain name pointer router.megacorpone.com. 215.169.222.51.in-addr.arpa domain name pointer siem.megacorpone.com. 216.169.222.51.in-addr.arpa domain name pointer snmp.megacorpone.com. 217.169.222.51.in-addr.arpa domain name pointer syslog.megacorpone.com. 218.169.222.51.in-addr.arpa domain name pointer support.megacorpone.com. 219.169.222.51.in-addr.arpa domain name pointer test.megacorpone.com. 220.169.222.51.in-addr.arpa domain name pointer vpn.megacorpone.com. ... ``` ### Enumeration with nslookup #### Standard DNS Lookup Do a standard DNS lookup (`A` record) with **nslookup** ```bash nslookup mail.megacorptwo.com ``` #### Query a specific record type To query a specific record type (in this case `TXT` record) with **nslookup** from a DNS-server with an IP-address of 192.168.50.151 ```bash nslookup -type=TXT info.megacorptwo.com 192.168.50.151 ``` ## Automated Enumeration ### Automated Enumeration with DnsEnum #### Do a default scan ```bash ┌──(kali㉿kali)-[~/OffSec_Cources] └─$ dnsenum megacorpone.com dnsenum VERSION:1.3.1 ----- megacorpone.com ----- Host's addresses: __________________ Name Servers: ______________ ns3.megacorpone.com. 300 IN A 66.70.207.180 ns2.megacorpone.com. 300 IN A 51.222.39.63 ns1.megacorpone.com. 300 IN A 51.79.37.18 Mail (MX) Servers: ___________________ spool.mail.gandi.net. 384 IN A 217.70.178.1 mail2.megacorpone.com. 300 IN A 167.114.21.69 fb.mail.gandi.net. 36 IN A 217.70.178.217 fb.mail.gandi.net. 36 IN A 217.70.178.215 fb.mail.gandi.net. 36 IN A 217.70.178.216 mail.megacorpone.com. 300 IN A 167.114.21.68 Trying Zone Transfers and getting Bind Versions: _________________________________________________ Trying Zone Transfer for megacorpone.com on ns3.megacorpone.com ... AXFR record query failed: REFUSED Trying Zone Transfer for megacorpone.com on ns2.megacorpone.com ... megacorpone.com. 300 IN SOA ( megacorpone.com. 300 IN TXT "Try megacorpone.com. 300 IN TXT ( megacorpone.com. 300 IN MX 10 megacorpone.com. 300 IN MX 20 megacorpone.com. 300 IN MX 50 megacorpone.com. 300 IN MX 60 megacorpone.com. 300 IN NS ns1.megacorpone.com. megacorpone.com. 300 IN NS ns2.megacorpone.com. megacorpone.com. 300 IN NS ns3.megacorpone.com. admin.megacorpone.com. 300 IN A 167.114.21.64 beta.megacorpone.com. 300 IN A 167.114.21.65 fs1.megacorpone.com. 300 IN A 167.114.21.66 intranet.megacorpone.com. 300 IN A 167.114.21.67 mail.megacorpone.com. 300 IN A 167.114.21.68 mail2.megacorpone.com. 300 IN A 167.114.21.69 ns1.megacorpone.com. 300 IN A 51.79.37.18 ns2.megacorpone.com. 300 IN A 51.222.39.63 ns3.megacorpone.com. 300 IN A 66.70.207.180 router.megacorpone.com. 300 IN A 167.114.21.70 siem.megacorpone.com. 300 IN A 167.114.21.71 snmp.megacorpone.com. 300 IN A 167.114.21.72 support.megacorpone.com. 300 IN A 167.114.21.74 syslog.megacorpone.com. 300 IN A 167.114.21.73 test.megacorpone.com. 300 IN A 167.114.21.75 vpn.megacorpone.com. 300 IN A 167.114.21.76 vpn2.megacorpone.com. 300 IN A 167.114.21.77 vpndev.megacorpone.com. 300 IN A 167.114.21.78 vpnprod.megacorpone.com. 300 IN A 167.114.21.79 www.megacorpone.com. 300 IN A 149.56.244.87 www2.megacorpone.com. 300 IN A 149.56.244.87 Trying Zone Transfer for megacorpone.com on ns1.megacorpone.com ... AXFR record query failed: REFUSED Brute forcing with /usr/share/dnsenum/dns.txt: _______________________________________________ ``` #### Scan with more threats Add `--threads X` to scan with more threads ```bash dnsenum offseclab.io --threads 100 ``` ### Automated Enumeration with DNSRecon #### Do a standard scan Let's run `dnsrecon` against megacorpone.com, using the `-d` option to specify a domain name and `-t` to specify the type of enumeration to perform (in this case, a standard scan) ```bash kali@kali:~$ dnsrecon -d megacorpone.com -t std [*] std: Performing General Enumeration against: megacorpone.com... [-] DNSSEC is not configured for megacorpone.com [*] SOA ns1.megacorpone.com 51.79.37.18 [*] NS ns1.megacorpone.com 51.79.37.18 [*] NS ns3.megacorpone.com 66.70.207.180 [*] NS ns2.megacorpone.com 51.222.39.63 [*] MX mail.megacorpone.com 51.222.169.212 [*] MX spool.mail.gandi.net 217.70.178.1 [*] MX fb.mail.gandi.net 217.70.178.217 [*] MX fb.mail.gandi.net 217.70.178.216 [*] MX fb.mail.gandi.net 217.70.178.215 [*] MX mail2.megacorpone.com 51.222.169.213 [*] TXT megacorpone.com Try Harder [*] TXT megacorpone.com google-site-verification=U7B_b0HNeBtY4qYGQZNsEYXfCJ32hMNV3GtC0wWq5pA [*] Enumerating SRV Records [+] 0 Records Found ``` #### Scan for sites To perform our brute force attempt, we will use the `-d` option to specify a domain name, `-D` to specify a file name containing potential subdomain strings, and `-t` to specify the type of enumeration to perform, in this case `brt` for brute force. ```bash kali@kali:~$ dnsrecon -d megacorpone.com -D ~/hosts.txt -t brt [*] Using the dictionary file: /home/kali/list.txt (provided by user) [*] brt: Performing host and subdomain brute force against megacorpone.com... [+] A www.megacorpone.com 149.56.244.87 [+] A mail.megacorpone.com 51.222.169.212 [+] A router.megacorpone.com 51.222.169.214 [+] 3 Records Found ``` ### Automated Enumeration with Nmap #### Enumerate SRV records ```bash nmap -v -p 53 --script dns-srv-enum $TARGET_IP ``` #### DNS Zone Transfer Attempts a zone transfer from a DNS server ```bash nmap -v -p 53 --script dns-zone-transfer $TARGET_IP ``` #### List of DNS scripts Nmap scripts are stored in the directory `/usr/share/nmap/scripts`. List of DNS-related NSE scripts:
NameDescription
broadcast-dns-service-discoveryAttempts to discover hosts' services using the DNS Service Discovery protocol. It sends a multicast DNS-SD query and collects all the responses.
dns-blacklistChecks target IP addresses against multiple DNS anti-spam and open proxy blacklists and returns a list of services for which an IP has been flagged. Checks may be limited by service category (eg: SPAM, PROXY) or to a specific service name.
dns-bruteAttempts to enumerate DNS hostnames by brute force guessing of common subdomains. With the dns-brute.srv argument, dns-brute will also try to enumerate common DNS SRV records.
dns-cache-snoopPerforms DNS cache snooping against a DNS server.
dns-check-zoneChecks DNS zone configuration against best practices, including RFC 1912. The configuration checks are divided into categories which each have a number of different tests.
dns-client-subnet-scanPerforms a domain lookup using the edns-client-subnet option which allows clients to specify the subnet that queries supposedly originate from. The script uses this option to supply a number of geographically distributed locations in an attempt to enumerate as many different address records as possible. The script also supports requests using a given subnet.
dns-fuzzLaunches a DNS fuzzing attack against DNS servers.
dns-ip6-arpa-scanPerforms a quick reverse DNS lookup of an IPv6 network using a technique which analyzes DNS server response codes to dramatically reduce the number of queries needed to enumerate large networks.
dns-nsec-enumEnumerates DNS names using the DNSSEC NSEC-walking technique.
dns-nsec3-enumTries to enumerate domain names from the DNS server that supports DNSSEC NSEC3 records.
dns-nsidRetrieves information from a DNS nameserver by requesting its nameserver ID (nsid) and asking for its id.server and version.bind values. This script performs the same queries as the following two dig commands: - dig CH TXT bind.version @target - dig +nsid CH TXT id.server @target
dns-random-srcportChecks a DNS server for the predictable-port recursion vulnerability. Predictable source ports can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
dns-random-txidChecks a DNS server for the predictable-TXID DNS recursion vulnerability. Predictable TXID values can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
dns-recursionChecks if a DNS server allows queries for third-party names. It is expected that recursion will be enabled on your own internal nameservers.
dns-service-discoveryAttempts to discover target hosts' services using the DNS Service Discovery protocol.
dns-srv-enumEnumerates various common service (SRV) records for a given domain name. The service records contain the hostname, port and priority of servers for a given service. The following services are enumerated by the script: - Active Directory Global Catalog - Exchange Autodiscovery - Kerberos KDC Service - Kerberos Passwd Change Service - LDAP Servers - SIP Servers - XMPP S2S - XMPP C2S
dns-updateAttempts to perform a dynamic DNS update without authentication.
dns-zeustracker

Checks if the target IP range is part of a Zeus botnet by querying ZTDNS @ abuse.ch. Please review the following information before you start to scan:

dns-zone-transferRequests a zone transfer (AXFR) from a DNS server.
#### Script Help You can get help about a specific NSE script with ```bash nmap --script-help http-enum ``` To get help about several scripts you can use wildcards such as ```bash nmap --script-help *http* ``` Or you can get help about all scripts in a specific category ```bash nmap --script-help discovery ``` ## Resources dig - Linux manual page: DNSENUM2 - Github: Dnsenum - Kali Tools: DNSRecon - Github: DNSRecon - Kali Tools: Domain Name System - Wikipedia: host - Linux manual page: List of DNS record types - Wikipedia: nslookup - Linux manual page: