Revision as of 19:09, 24 April 2012

Domain Name System

DNS resolves hostnames to IP addresses and vice versa. DNS records also control the appointment of servers to control e-mail.

DNS Basics

The DNS system is used to resolve domain names (such as www.blackhatacademy.org) into 4-byte addresses (such as 173.245.60.117) known as IP addresses or (more rarely) DNS addresses. It can be used to obtain a wealth of information concerning a website, all of which can be useful for troubleshooting, penetration testing and recon.

DNS Recon

In this example, random.com is given as a site that the hacker wishes to learn more about. The first step in a hacker's DNS recon might be to type:

That will return basic information on the site, ip addresses (a records, aaaa for v6) and mail servers (mx records). For a little bit more information, use the -a flag, it will return everything from txt records to dnssec records.

Taking it a bit further, you can really start to pull a lot of information from DNS given the right circumstances. For example, if a domain name server has axfr's (zone transfers) enabled for everyone, you can get a list of subdomains for any domain name on that server. The easiest way to do this would be something like this:

This would give return the dns servers for random.com, allowing you to do something like:

In order to perform a successful zone transfer, you usually want to directly specify the name server. Here is an example of a successful zone transfer:

Records

MX Record

Mail eXchanger Record

This record prioritizes email delivery for specific domains over multiple protocols.

SYNTAX:

 domain.tld. TTL IN MX domain.tld

• The first domain.tld. represents the mailserver hostname.
• The second domain.tld represents the domain name to deliver mail for
• This can only be added to the record containing the primary A record to be effective.

CNAME Record

DNAME Record

A Record

DNS Server Software

• Bind
• Dnsmasq
• PowerDNS
• djbdns
• rbldnsd

DNS Utilities

• YouGetSignal

• dig