[BT5] Information collection 1-1 Dnsenum

0. Introduction of tools

The purpose of Dnsenum is to gather as much information as possible about a domain. The program currently performs the following operations:

1) Get The host ' s Addresse (A record). 2) Get the Namservers (threaded). 3) Get the MX record (threaded). 4) Perform AXFR queries on nameservers and get BIND versions (threaded). 5) Get extra names and subdomains via Google scraping (google query = "Allinurl:-www site:domain"). 6) Brute force subdomains from file, can also perform recursion on subdomain that has NS records (all threaded). 7) Calculate C class domain network ranges and perform WHOIS queries on them (threaded). 8) Perform Reverse lookups on netranges (C class Or/and whois netranges) (threaded). 9) Write to Domain_ips.txt file ip-blocks.

1. Tool position

command line [email protected]:/pentest/enumeration/dns/dnsenum#

Dir View directory with Dns-big.txt, dns.txt two dictionary files, README.txt usage instructions and dnsenum.pl main script

Graphical interface Applications--BackTrack--Information gathering--Network analysis--dnsanalysis

2. Tool parameters

-F dns.txt Specifies a brute force file that can be replaced with dns-big.txt

-dnsserver Specifying a DNS server

cisco.com target domain name

-O cisco.xml output to Cisco.xml

3. Partial use examples

[email protected]:/pentest/enumeration/dns/dnsenum# ./dnsenum.pl cisco.comdnsenum.pl VERSION:1.2.2-----   cisco.com   -----Host‘s addresses:__________________ cisco.com                                83265    IN    A        198.133.219.25Name Servers:______________ns2.cisco.com                            5263     IN    A        64.102.255.44ns1.cisco.com                            600      IN    A        72.163.5.201Mail (MX) Servers:___________________ams-mx-01.cisco.com                      38590    IN    A        64.103.36.169rtp-mx-01.cisco.com                      38590    IN    A        64.102.255.47rcdn-mx-01.cisco.com                     75891    IN    A        72.163.7.166alln-mx-01.cisco.com                     64280    IN    A        173.37.145.198Trying Zone Transfers and getting Bind Versions:_________________________________________________Trying Zone Transfer for cisco.com on ns2.cisco.com ... AXFR record query failed: NOERRORns2.cisco.com Bind Version:                             UnavailableTrying Zone Transfer for cisco.com on ns1.cisco.com ... AXFR record query failed: NOERRORns1.cisco.com Bind Version:                             Unavailable Wildcards detected, all subdomains will point to the same IP address, bye.

4. Description

Use the./dnsenum.pl cisco.com to detect the default DNS server IP, which is the corresponding IP for ns1.cisco.com and ns2.cisco.com above.

It's going to be used next, like the 72.163.5.201 here.

Here is the introduction of zone transfers, it is not difficult to understand that this machine does this must be a failure

Http://en.wikipedia.org/wiki/DNS_zone_transfer

5. Full Use example

[Email protected]:/pentest/enumeration/dns/dnsenum#./dnsenum.pl-f dns-big.txt-dnsserver 72.163.5.201 Cisco.com-o Cisco.xml

Note: Using the Dns-big.txt dictionary is estimated to take more than 3 hours

[BT5] Information collection 1-1 Dnsenum