DNS Enumeration - Port 53

 

#Find the DNS server 
nmap --script vuln,vulners --script-args mincvss=7.0 -sC -sV -p 53 --open 10.10.0.0/16

nmap -sU -sV --script "dns* and (discovery or vuln) and not (dos or brute)" -p53 10.10.10.10

#DNS Server Processes Unauthoritative Recursive Queries
nmap -Pn -p 53 -sU --script dns-recursion 10.10.10.10

#DNS Server Cache Snooping Remote Information Disclosure
nmap -Pn -sU -sV -p 53 --script dns-cache-snoop 10.10.10.10

#DNS Enum via Metasploit
auxiliary/gather/enum_dns

auxiliary/scanner/dns/dns_amp

# DNS Enum 

nslookup
>SERVER 10.10.10.1
# Give the ip address of the server to find its hostname 
> 10.10.10.10 
10.10.10.10.in-addr.arpa      name = host02.test.domain.

dig axfr host02.test.domain @10.10.10.1

Finding SPF Records
-all (Hard Fail): Strict rejection of emails from unauthorized servers.
~all (Soft Fail): Flag or mark emails from unauthorized servers as suspicious.
+all (Allow All): Allows emails from any server, effectively disabling SPF checks.
?all (Neutral): No strong recommendation; recipient decides.

#Single domain 
dig txt <fqdn> | grep "include:_spf"

#Bulk Scan 
while read -r domain; do echo "$domain:"; dig txt "$domain" | grep "include:_spf"; done < domains.txt

Checking DMarc Records 

- Start with p=none, review reports to ensure legitimate senders are authenticated, and then move to stricter policies (p=quarantine or p=reject). 
Example: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;

#Single Domain
dig txt _dmarc.example.com 

#Bulk Scan
while read -r domain; do echo "$domain:"; dig txt "_dmarc.$domain" | grep "DMARC"; done < domains.txt

#Find the Domain Name of the DC
ldapsearch -x -h "10.10.10.1" -s base

#Find some info or creds
ldapsearch -LLL -x -H ldap://DOMAIN.FQDN.COM -b '' -s base '(objectclass=*)'

DNS Enum via DIG 

dig @[server] [name] [type]
dig -t SRV _gc._tcp.<domain fqdn>
dig -t SRV _ldap._tcp.<domain fqdn>
dig -t SRV _kerberos._tcp.<domain fqdn>
dig -t SRV _kpasswd._tcp.<endpoint fqdn>
dig txt <fqdn> | grep "include:_spf"
dig txt _dmarc.example.com

nmap --script dns-srv-enum --script-args "dns-srv-enum.domain"='DOMAIN.FQDN.COM'

DNS Zone transfer 

#To get dig to perform a zone transfer, we invoke it with the -t AXFR notation as
dig @[server] [domain] -t AXFR

#Pull all information about a given domain. Alternatively, dig can perform an incremental zone transfer, pulling only recently updated records, using this syntax:
#N is an integer that refers to the serial number of a Start of Authority record
 dig @[server] [domain] -t IXFR=[N]

DNSRecon Cheatsheet

#List all the DNS entries in the domain
dnsrecon -r "10.10.0.0/16"

#Scan a domain 
dnsrecon -d hackingdream.net

# -t = standard DNS records (default), 
#reverse IP address lookup(rvl), 
#zone transfers(axfr),
#DNSSEC zone walks (zonewalk), and 
#cache  nooping(snoop)
dnsrecon -d domain.FQDN -t type

#Displays S0A, NS, A, AAAA, MX, and SRV of the target domain
dnsrecon -d [domain]

#Performs reverse DNS lookup for IP address or CIDR range
dnsrecon -d [domain] -t rvl

#Attempts a zone transfer of all NS record nameservers
dnsrecon -d [domain] -t axfr

#Performs a DNSSEC zone walk by querying for NSEC records
dnsrecon -d [domain] -t zonewalk

#Scans for DNS cache snooping using a supplied dictionary file
dnsrecon -d [domain] -t snoop -D [dictionary file] 

#Bruteforcing DNS sub-domains 
dnsrecon -d 10.10.10.1 -t brt -D /usr/share/wordlists/dnsmap.txt 
dnsenum domain.fqdn.com fierce -dns domain.fqdn.com -wordlist dictionary.txt

Can also use DNSDumpster --> Online tool to identify DNS records

- Check for all the DNS records/Sub-Domains
- MX records usually show the email service provider details (outlook or whatever service they are using)

DNS Zone Transfer

host -la $DOMAIN. $DNSSERVER
perl fierce.pl -dns $DOMAIN. -search $HOST
dig axfr $TARGET @$DNSSERVER
dnsrecon -d $DOMAIN -t axfr