Skip to main content

DNS Enumeration - Port 53



#Find the DNS server 

nmap --script vuln,vulners --script-args mincvss=7.0 -sC -sV -p 53 --open 10.10.0.0/16

nmap -sU -sV --script "dns* and (discovery or vuln) and not (dos or brute)" -p53 10.10.10.10

#DNS Server Processes Unauthoritative Recursive Queries
nmap -Pn -p 53 -sU --script dns-recursion 10.10.10.10
#DNS Server Cache Snooping Remote Information Disclosure
nmap -Pn -sU -sV -p 53 --script dns-cache-snoop 10.10.10.10
#DNS Enum via Metasploit
auxiliary/gather/enum_dns

auxiliary/scanner/dns/dns_amp

# DNS Enum 

nslookup
>SERVER 10.10.10.1
# Give the ip address of the server to find its hostname 
> 10.10.10.10 
10.10.10.10.in-addr.arpa      name = host02.test.domain.

dig axfr host02.test.domain @10.10.10.1
Finding SPF Records

  • -all (Hard Fail): Strict rejection of emails from unauthorized servers.
  • ~all (Soft Fail): Flag or mark emails from unauthorized servers as suspicious.
  • +all (Allow All): Allows emails from any server, effectively disabling SPF checks.
  • ?all (Neutral): No strong recommendation; recipient decides.
    • 
#Single domain 
dig txt <fqdn> | grep "include:_spf"

#Bulk Scan 
while read -r domain; do echo "$domain:"; dig txt "$domain" | grep "include:_spf"; done < domains.txt

    Checking DMarc Records 

- Start with p=none, review reports to ensure legitimate senders are authenticated, and then move to stricter policies (p=quarantine or p=reject). 
Example: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;

#Single Domain
dig txt _dmarc.example.com 

#Bulk Scan
while read -r domain; do echo "$domain:"; dig txt "_dmarc.$domain" | grep "DMARC"; done < domains.txt
    #Find the Domain Name of the DC
ldapsearch -x -h "10.10.10.1" -s base

#Find some info or creds
ldapsearch -LLL -x -H ldap://DOMAIN.FQDN.COM -b '' -s base '(objectclass=*)'

    DNS Enum via DIG 
    
    dig @[server] [name] [type]
dig -t SRV _gc._tcp.<domain fqdn>
dig -t SRV _ldap._tcp.<domain fqdn>
dig -t SRV _kerberos._tcp.<domain fqdn>
dig -t SRV _kpasswd._tcp.<endpoint fqdn>
dig txt <fqdn> | grep "include:_spf"
dig txt _dmarc.example.com

nmap --script dns-srv-enum --script-args "dns-srv-enum.domain"='DOMAIN.FQDN.COM'
    DNS Zone transfer 

    #To get dig to perform a zone transfer, we invoke it with the -t AXFR notation as
    dig @[server] [domain] -t AXFR

    #Pull all information about a given domain. Alternatively, dig can perform an incremental zone transfer, pulling only recently updated records, using this syntax:
    #N is an integer that refers to the serial number of a Start of Authority record
     dig @[server] [domain] -t IXFR=[N]
    DNSRecon Cheatsheet

    #List all the DNS entries in the domain
dnsrecon -r "10.10.0.0/16"

    #Scan a domain 
    dnsrecon -d hackingdream.net

    # -t = standard DNS records (default), 
    #reverse IP address lookup(rvl), 
    #zone transfers(axfr),
    #DNSSEC zone walks (zonewalk), and 
    #cache  nooping(snoop)
    dnsrecon -d domain.FQDN -t type

    #Displays S0A, NS, A, AAAA, MX, and SRV of the target domain
    dnsrecon -d [domain]

    #Performs reverse DNS lookup for IP address or CIDR range
    dnsrecon -d [domain] -t rvl

    #Attempts a zone transfer of all NS record nameservers
    dnsrecon -d [domain] -t axfr

    #Performs a DNSSEC zone walk by querying for NSEC records
    dnsrecon -d [domain] -t zonewalk

    #Scans for DNS cache snooping using a supplied dictionary file
    dnsrecon -d [domain] -t snoop -D [dictionary file] 

#Bruteforcing DNS sub-domains 
dnsrecon -d 10.10.10.1 -t brt -D /usr/share/wordlists/dnsmap.txt 
dnsenum domain.fqdn.com fierce -dns domain.fqdn.com -wordlist dictionary.txt
    Can also use DNSDumpster --> Online tool to identify DNS records

    - Check for all the DNS records/Sub-Domains
    - MX records usually show the email service provider details (outlook or whatever service they are using)
    DNS Zone Transfer
    
    host -la $DOMAIN. $DNSSERVER
perl fierce.pl -dns $DOMAIN. -search $HOST
dig axfr $TARGET @$DNSSERVER
dnsrecon -d $DOMAIN -t axfr     
    Labels:

    Comments

    Post a Comment

    Popular posts from this blog

    MSRPC (Microsoft Remote Procedure Call) Pentesting - Port 135

      It is also known as a function call or a subroutine call. Default ports are 135, 593. Enumeration nmap --script msrpc-enum -p 135 <target-ip> RPC Endpoints To enumerate RPC endpoints, use impacket-rpcdump. impacket-rpcdump -port 135 <target-ip> | grep -E 'MS-EFSRPC|MS-RPRN|MS-PAR' MS-EFSRPC: It might be vulnerable to PetitPotam. MS-RPRN, MS-PAR: It might be vulnerable to PrintNightmare. Metasploit msfconsole msf> use auxiliary/scanner/dcerpc/endpoint_mapper msf> use auxiliary/scanner/dcerpc/hidden msf> use auxiliary/scanner/dcerpc/management msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor Connect # Anonymous logon rpcclient -N -U "" <target-ip> rpcclient -N -U "" -p 593 <target-ip> rpcclient -N -U "" dc.example.local # Specify username # -W: Workgroup # -N: No password rpcclient -U username <target-ip> rpcclient -W WORKGROUP -U username <target-ip> rpcclient -U username -N <target-ip...
    Post a Comment
    Read more

    Thread Modelling Cheatsheet: Know Your Weaknesses Before Attackers Do!

    Threat Modelling Part - 1 What is Threat Modelling?      Threat modelling is the process of identifying, assessing, and mitigating potential security threats before they happen. It helps teams anticipate how systems can be attacked and build defences proactively , not reactively. Key Concepts Threat: Something (like a hacker or malware) that could exploit a weakness. Vulnerability: A flaw in your system that can be exploited. Risk: The chance that a threat will exploit a vulnerability to cause damage. Analogy : Threat = Burglar Vulnerability = Unlocked door Risk = Getting robbed because the door is open in a bad neighborhood  Threat Modelling Process (High-Level) Define the Scope – What systems/apps are you evaluating? Identify Assets – What needs protection? (e.g. data, services) Identify Threats – Think like an attacker. What could go wrong? Analyze Vulnerabilities – What weaknesses exist? Prioritize Ri...
    Post a Comment
    Read more

    PostgreSQL - Port 5432

      PostgreSQL, also known as Postgres, is a powerful open-source object-relational database system. It has earned a strong reputation for its proven architecture, reliability, data integrity, robust feature set, and extensibility. Identify PostgreSQL nmap -sV -p 5432 <target-host> nmap Scanning nmap -sC -sV --script vuln,vulners --script-args mincvss=7.0 -p5432,5433 -Pn 10.10.10.10 #make sure to check for vulnerable versions nmap -sV -p 5432 <target-host> Exploiting Known Vulnerabilities searchsploit postgresql <version> Enumerating Databases and Tables List all databases \l Switch to a database \c <database_name> List tables in the current database: \dt Extract data from a specific table: SELECT * FROM <table_name>; Dumping Hashes SELECT usename, passwd FROM pg_shadow; Accessing File System COPY (SELECT * FROM sensitive_table) TO '/tmp/sensitive_data.txt'; Bruteforcing Postgres Creds #Using Metasploit use auxiliary/scanner/postgr...
    Post a Comment
    Read more