53 - Pentesting DNS

Basic Information

The Domain Name Systems (DNS) is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DN S translates domain names to IP addresses so browsers can load Internet resources. From here.

Default port: 53

PORT     STATE SERVICE  REASON
53/tcp   open  domain  Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
5353/udp open  zeroconf udp-response
53/udp   open  domain  Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)

Enumeration

DNS does not have a "banner" to grab. The closest equivalent is a magic query for version.bind. CHAOS TXT which will work on most BIND nameservers. You can perform this query using dig:

dig version.bind CHAOS TXT @DNS

If that does not work you can use fingerprinting techniques to determine the remote server's version -- the fpdns tool is one option for that, but there are others.

You can grab the banner also with a nmap script:

--script dns-nsid

Zone Transfer

More info

Using nslookup

Useful metasploit modules

Useful nmap scripts

DNS - Reverse BF

Another tool to do so: https://github.com/amine7536/reverse-scan

You can query reverse IP ranges to https://bgp.he.net/net/205.166.76.0/24#_dns (this tool is also helpful with BGP).

DNS - Subdomains BF

Active Directory servers

DNSSec

IPv6

Brute force using "AAAA" requests to gather IPv6 of the subdomains.

Bruteforce reverse DNS in using IPv6 addresses

DNS Recursion DDoS

If DNS recursion is enabled, an attacker could spoof the origin on the UDP packet in order to make the DNS send the response to the victim server. An attacker could abuse ANY or DNSSEC record types as they use to have the bigger responses. The way to check if a DNS supports recursion is to query a domain name and check if the flag "ra" (recursion available) is in the response:

Non available:

Available:

Mail to nonexistent account

From book: Network Security Assessment (3rd edition)

Simply sending an email message to a nonexistent address at a target domain often reveals useful internal network information through a nondelivery notification (NDN).

The following data in this transcript is useful:

  • Internal hostnames, IP addresses, and subdomain layout

  • The mail server is running Microsoft Exchange Server 2010 SP3

  • A Barracuda Networks device is used to perform content filtering

Config files

上一页43 - Pentesting WHOIS下一页69/UDP TFTP/Bittorrent-tracker

最后更新于

这有帮助吗？