DNS recon, or DNS reconnaissance.
In this video, we're going to be taking a look at how
to perform DNS reconnaissance.
So again, remember, this falls under passive information
gathering, which means we're not really
going to be actively engaging with the DNS server.
So we're not going to be performing anything
like DNS zone transfer.
We're simply trying to identify the records associated
with a particular domain.
So we're trying to identify A records,
maybe the mail server, IP address, TXT records, anything
that could provide us with a better understanding as to how
the target website or a target system is configured to run.
And in this case, we're primarily
going to be focusing on websites, because that's really
where DNS comes into play.
So again, I'm going to be running this or performing
this practical demonstration on my Kali Linux VM.
And the reason for that, as I said previously,
is because we're essentially utilizing the internet.
So I'm just going to switch over to my Kali Linux VM,
and we can get started.
So I'm back on my Kali Linux VM.
And the first tool that we're going to be taking a look at
is a tool called DNSRecon.
So if I just perform a quick Google search for DNSRecon,
this will bring up the tool here.
I'm just going to accept here, because Google
thinks that I'm a robot for some weird reason, but there we are.
The Google search is complete.
So as you can see, DNSRecon is a Python script
that provides you the ability to perform or check all name
server records for zone transfers,
enumerate general DNS records, which
is what we're looking for here, for a particular domain name.
So we're looking for the actual mail server address,
the actual name server A addresses,
which is IPv4 addresses, IPv6 addresses,
and of course, the TXT records here.
So DNSRecon comes pre-packaged with Kali Linux.
So we don't need to install it.
To use it, we can simply type in dnsrecon.
And I can open up the Help menu here.
Although, we're really not going to be performing--
we're not going to be taking a look at how to utilize it
extensively, because there are other resources,
like DNSdumpster, which I'll get to in a second.
But it's fairly easy to understand.
We simply need to say, dnsrecon, and then specify
the domain name, which in this case,
we're going to be using hackersploit.org.
There we are.
And it's going to take a few seconds.
And once it's done, it's going to output a lot of information.
Now, in this case, this may look a little bit confusing,
but let me explain what's happening here.
So when we're performing passive DNS reconnaissance,
we're essentially trying to look for the name server addresses.
In this case, we know it's Cloudflare.
So it provides us with the name server, the primary name
server used by a site--
as I said, in this case, it's Cloudflare--
and then any other records, like the A record,
which is the IPv4 address of the website, which
in this case because it's going through Cloudflare
is not the accurate one.
We then have the AAAA records, which
is referring to IPv6 addresses.
And then, of course, the other important piece of information
is the actual mail server address
denoted by the MX record here, which
points to the following IP.
So that's very important, because if you perform
your research, you know that Cloudflare really
doesn't hide our proxy mail server addresses really well.
So am I secretly revealing something to you?
But if we perform this on a site like zonetransfer.me,
which I'll just do right now.
Let me just clear my terminal.
So I'll say dnsrecon, and d.
And I can then say zonetransfer.me.
You'll be able to see what I'm talking about.
So you can see that, firstly, DNSSEC is not configured.
It'll tell us the actual name server, which in this case,
it provides the domain, and then the mapped IP address.
And then, of course, we have the various MX records.
Now, in this case, it looks like it failed,
but that's not really a problem in this case.
So we have various MX records that
point to, in certain cases, different addresses.
But from this, you can pretty much
tell what email service or email server
is being used by this particular company organization.
In this case, it looks like they are using Google Mail, or G
Suite, if you will, because we can see quite a few Google Mail
MX records here.
And then, of course, we get the IP address of the actual site,
which is the A record here.
And then, of course, we get a TXT record,
which are essentially used for diagnostic information.
In this case, it's google-site-verification.
A TXT record, that is typically used
whenever you want to track a website's analytics
with Google.
They'll typically tell you to add a DNS record, a TXT DNS
record, and add the following information.
So in this case, it's the domain name itself.
And then this is the actual value contained
within the actual TXT record.
So that's how to use DNSRecon.
Now, a tool that I really recommend that you use
and one that I personally use for pen tests is a site
called DNSdumpster, which essentially performs
DNS reconnaissance, research, and it essentially
finds and performs a lookup on DNS records.
Very similar to what DNSRecon does, but the way it
sorts and organizes the information
is absolutely fantastic.
So as it says here, "DNSdumpster.com
is a free domain research tool that can discover hosts
related to a domain.
Finding visible hosts from the attacker's perspective
is an important part of the security assessment process."
Indeed, it is.
So I'll just enter my site here, so hackersploit.org.
We'll give this a couple of seconds, and there we are.
So firstly, it's going to show you the IP block owners.
In this case, they all belong to Cloudflare.
So it'll provide us with the DNS servers
used by this website, which in this case are the following.
So you have dee.ns.cloudflare.com,
and jim.ns.cloudflare.com and the respective IP addresses.
It then provides you with the organization name
that owns that particular IP and the location.
And if we click on this here, you
can see you can get the HTTP headers from this particular IP
address.
You can attempt a zone transfer, which we'll not do right now.
You can also trace a path to an IP address using MTR.
You can also find hosts sharing this DNS service.
So for example, if we identified this particular DNS server,
we could also try and see what other websites
or what other hosts are using this DNS server.
And we can also search the banners
for net block, which is passive.
And that's one of the great things about DNSdumpster
is it will actually classify the checks
you are performing based on whether or not
they're passive or active.
So in this case, we can perform the actual find
hosts sharing this DNS server.
And this will give you a list.
In this case, it tells us "No DNS server records found."
That's perfectly fine.
We'll get back to that in a second.
But then we have the MX record, which
points to the mail server, and in this case,
premium58 web-hosting.
That's owned by NAMECHEAP.
And we can then--
again, if we click on--
this is because this is a MX record.
This is essentially pointing to any mail server that has been
configured for this domain.
The additional checks we can perform are an nmap port scan.
But that's active.
And by the way, this is being done on the website itself.
But yeah, we essentially get the TXT records,
which you can see this site has been verified by Google.
And there are a couple of other TXT records.
And then, of course, we get additional A records.
And in this case, we've been able to identify a subdomain.
In this case, it's pointing to forum.hackersploit.org.
So we can open that up.
And indeed, we can see that hackersploit does have a forum.
Interesting.
So you can see how useful this is.
We've already been able to identify subdomains
just by performing DNS reconnaissance.
And of course, this is passive.
And of course, we have the actual A record
for the hackersploit.org domain here.
We can also perform a tracepath.
And in this case, a valid key is required.
So we will not get to that, but you
can download an Excel spreadsheet of all the hosts,
or you can view the graph.
That essentially gives you a graphical view
of the DNS reconnaissance we have performed.
So the reason why I like this is because you can actually
see that we have the following domains within Cloudflare.
So these are being protected by Cloudflare.
So this is the domain itself.
We then have the A records themselves,
which are being protected by Cloudflare.
We have the respective domains and the IP addresses.
And then we have the name servers.
So we have jim.ns, and dee.ns.cloudflare.com.
The mail server is not being protected
by Cloudflare, which is very, very important, which is why
I wanted to showcase this tool.
The other cool thing is you can actually export this as a PNG
or download it as an Excel spreadsheet, which
is absolutely fantastic.
So if I download this as a PNG, it is going to save this here.
It should be downloaded shortly.
Let's see whether this is done.
It's probably still downloading.
So that is downloaded under my Downloads directory
as export.png.
And you can see we pretty much have
the same image where you actually
selected or cropped to.
So I really like that.
And of course, you can see that it actually
maps the domain for you.
So you can actually click on this
to get the full-size image.
But the really cool thing about this is it maps it in a way
that you can understand.
So we have the domain hackersploit.org.
For DNS, we have the two name servers, right?
You can see them right over here.
So we have dee and jim, and they point to their own addresses.
These all belong to Cloudflare.
We then have the MX record, which is the mail server.
It then tells us the IP address of the mail server.
We then have an A record for the forum, which is a subdomain,
and that points to the following address here.
And that, of course, is protected by Cloudflare.
And of course, we have the main domain or the main A record,
which is hackersploit.org.
And that points to the following IP, which is, again
protected by Cloudflare.
Really cool stuff.
So that is DNSdumpster in a nutshell.
Now, we can also run this on another website.
So I'll just run this on zonetransfer.me,
because this will reveal a little bit more information.
So I'll just click on Search there.
And hopefully, there we are.
So it's going to perform the DNS lookup now.
So you can see we have the DNS servers here.
They point to the specific IPs.
And in this case, you can see one of the host names points
to AWS.
So that means that one of these name servers is being hosted.
One of these DNS servers is being hosted on AWS.
Very interesting.
We then have MX records.
These are the mail server records here
that point to Google really.
So that means that they're using Gmail or G Suite.
And then we have a TXT record, and the A records here.
We can view the graph here to get a better understanding
of the target infrastructure.
So you can see we have the zonetransfer.me website.
We then have the name server.
That's not being protected by any proxy or any firewall.
And one of them has the IP here.
That is nsztm2.digi.ninja.
That is running on AWS.
And then we have the primary one here
because it has the one there with the IP address there.
And it also looks like we have OVH here.
So that's an A record.
That's zonetransfer.me.
And then we have all of these MX records
that all fall under Google.
So you can see that these are all the MX records.
So I really like this graph because it gives you
a very good hierarchical view of the organization
and how everything interpolates with each other
from a DNS perspective.
And of course, it provides you with the actual domain mapping
here, which you can explore yourself.
So really, really cool stuff.
So that is how to perform passive DNS reconnaissance.
And that is going to conclude the practical demonstration
side of this video.
In the next video, we're going to be taking a look
at how to detect firewalls or how
to identify whether a website is being protected by a proxy
or firewall.
So I'll be seeing you in the next video.