Domain Cache detection (DNS cache snooping) technology

Domain Cache detection (DNS cache snooping) technology

In a corporate network, DNS servers are typically configured to provide domain name resolution services for hosts within the network. These DNS not only resolves their own private domain name, but also recursively, requesting public DNS to resolve third-party domain names, such as baidu.com. To improve performance, it is common to use cached records to record resolved domain names, especially third-party domain names.

Domain name cache detection (DNS cache snooping) technology is to send domain name resolution requests to these servers, but requires no recursive mode. This allows DNS to resolve only the domain names that are stored in the private domain and cache. With this technology, penetration testers know which domain names have been requested. For example, a tester can submit a domain name that is used by a security software update, and if there is a record, it indicates that the network uses that type of security software.

The Recon-ng tool provided by Kali Linux provides the module cache_snoop for this technology.

Domain Cache detection (DNS cache snooping) technology