DNS Enumeration

DNS - Domain Name System is often a very rich source of information when doing Active Information Gathering.

Enumerating the DNS involves interacting with the DNS server to gather information about Forward and Reverse lookup. You may have to sometimes Brute force the Forwad and Reverse lookups to gather required information.

One may also attempt to do a Zone Transfer.

If you are not familiar with the terminology in DNS I recommend grab a system admin book and have a nice read. This is really important before you  attempt information gathering during your penetration test.

Kali has some very good tools to make your job easier:

[1] DNSRecon - This is an excellent script written in Python.

Usage: dnsrecon -d <domain name> -t axfr



In the above example the zone transfer failed.

[2] DNSENUM (automatically attempts Zone Transfer as well)

usage: dnsenum <domain name>





Here as well the zone transfer has failed indicating the system is configured good.

The idea was to let you know the available options in your penetration testing destro so that you can use it when needed.

If you had to do this manually?

Well its not that difficult:

Let us consider we have an Ubuntu box and we plan to do some basic DNS enumeration.

host <domain name>  - This will attempt to resolve the hostname and provide the IP address.



Now this domain name can be associated with various common hosts e.g. mail, router, proxy, ftp etc.


mail.blogspot.com
router.blogspot.com
proxy.blogspot.com
ftp.blogspot.com

etc etc.

So lets have these in a list viz. names.txt

nano names.txt



save this file. And quickly verify that the file is saved.



Now let's automate the lookup

for ip in $(cat names.txt); do host $ip.blogspot.com; done 

The result will indicate  for the positive results from our brute force if any.

Once this is done we will have the IP addresses for the entries for which the brute force was successful.
However now, you can do a reverse lookup brute force as now you have the IP range (indicative).

For reverse Lookup:
for ip in $(seq 155 220); do host x.x.x.$ip; done | grep -v "not found" 

This way you will have the names and IPs.

Now for zone transfer:
A zone file has important information like the names, addresses and functionalities of the servers. Zone transfer is replication of this information from the master DNS server to the slave DNS servers. Ideally this should be allowed between the authorized servers. However, if this is not configured correctly then anyone requesting for the zone file will receive it.

As such the compromise of the zone file i.e. successful zone transfer does not mean that the network is compromised, however, this definitely facilitate for the same.

In order to do a zone transfer there are 2 parameters required:
[1] The domain name and 
[2] The name server (dns server address)

Finding the name server:

host -t ns <domain name> |cut -d " " -f 4


So in order to do the zone transfer our command will be:

host -l <domain name> <dns server address>



If you have multiple name servers then you can keep trying each to see if the zone transfer is successful.

Another option will be to write a script to automate this process.

All these above manual steps and the task of automating these can be achieved by the help of the 2 tools / scripts that we talked about. i.e. DNSRecon and dnsenum.

However you must know how the tool works and what the script does, before you use it blindly. Hope you enjoyed DNS enumeration.