<

How to Perform DNS Enumeration

Published on
3,234 Points
134 Views
1 Endorsement
Last Modified:
Editors:
Austin Songer, CEH, ECSA
CERTIFIED EXPERT
Trusted Navy Veteran | Technology Mindset | Information Security Focused
DNS enumeration offers TONS of helpful info on public servers, including IP addresses, server names, and purposes. Let's take a closer look.

DNS offers a variety of information about public organizations servers, such as IP addresses, server names, and server purposes. Let’s take a closer look at how to perform DNS enumeration.


Interacting With a DNS Server

1
2
> host -t ns example.com           # -t : type , ns: dns
> host -t mx example.com           # mx : mail server



You can also use nslookup!



1
> nslookup example.com



You can also use dig, which is my favorite



1
> dig example.com


Automating Lookups


We have some initial data from the megacorpone.com domain, we can continue to use additional DNS queries to discover more hostnames and IP addresses belonging to megacorpone.com.


Forward Lookup Brute Force


Automate the Forward DNS Lookup of common hostnames using the host command and a Bash script.


1
2
3
4
5
6
7
8
> echo www > list.txt
> echo ftp >> list.txt
> echo mail >> list.txt
> echo owa >> list.txt
> echo proxy >> list.txt
> echo router >> list.txt
> echo api >> list.txt
> for ip in $(cat list.txt);do host $ip.example.com;done


Reverse Lookup Brute Force


1
2
> for ip in $(seq 155 190);do host XX.x.x.$ip;done | grep -v "not found"
# grep -v :: --invert-match


DNS Zone Transfers


A zone transfer is similar to a database replication act between related DNS servers. This process includes the copying of the zone file from a master DNS server to a slave server. The zone file contains a list of all the DNS names configured for that zone. Zone transfers should usually be limited to authorized slave DNS servers.


1
2
3
4
5
> host -l example.com ns1.example.com 
# ns1 refused us our zone transfer request and -l :: list all hosts in a domain
> host -l example.com ns2.example.com
# The result is a full dump of the zone file for the alight.com domain
# which providing us a convenient list of IPs and DNS names for the alight.com domain.


Receiving the Given Domain in a Clean Format


1
2
3
> host -t ns example.com | cut -d " " -f 4
 # -d :: --delimiter=DELIM ;
 # -f ::  --fields=LIST select only these fields on each line;


Simple Zone Transfer Bash Script


1
2
3
4
5
6
7
8
9
10
11
12
13
14
# /bin/bash
# Simple Zone Transfer Bash Script
# $1 is the first argument given after the bash script
# Check if argument was given, if not, print usage
if  [-z "$1" ]; then
echo "[-] Simple Zone transfer script"
echo "[-] Usage : $0 <domain name> "
exit 0
fi
# if argument was given, identify the DNS servers for the domain
for server in $(host ­-t ns $1 | cut ­-d" " ­-f4);do
# For each of these servers, attempt a zone transfer
host -l $1 $server | grep "has address"
done


Using Kali Linux Tools


DNSRecon


1
2
3
4
> dnsrecon -d example.com -t axfr
# -d :: domain
# -t :: type of Enumeration to perform
# axfr :: test all ns servers for zone transfer


DNSEnum


1
> dnsenum example.com
1
Ask questions about what you read
If you have a question about something within an article, you can receive help directly from the article author. Experts Exchange article authors are available to answer questions and further the discussion.
Get 7 days free