This post intends to provide a list of helpful commands and tools that you can use when enumerating Port 53 on a machine. This list is far from exhaustive and will be updated as time progresses.
Enumerating Hostname of Server
Run the following commands to see if you can make the server leak its own hostname.
nslookup
server <targetIP>
127.0.0.1
127.0.0.2<targetIP>
Note: It’s probably worth enumerating other live hosts on the network to confirm the domain name is the same.
Performing DNS enumeration with Nslookup
To perform a lookup of the A records against a particular domain:nslookup <targetDomain>
To look up the mail records:nslookup -query=mx <targetDomain>
To look up Nameservers:nslookup -query=ns <targetDomain>
To get all records that are available:nslookup -query=any <targetDomain>
You can also drop into nslookup with no parameters interactively. nslookup
While interactively working with nslookup, you can set your query:
set q=mx
You can also set your server if you wanted to query a different DNS server than your default one:
server 8.8.8.8
Performing DNS enumeration with Dig
To extract A records and Namerservers of a domain:dig <targetDomain>
To query just A records:dig <targetDomain> A
You can also limit the output to a specific record, and just return the answer section:dig +nocmd <targetDomain> MX +noall +answer
Can attempt a DNS Zone transfer:sudo dig @<targetDNSServer> <targetDomain> -t AXFR +nocookie
To see more about a DNS Zone Transfer, see https://infinitelogins.com/2020/04/23/performing-dns-zone-transfer/
Automating DNS Enumeration
Fierce can be used to enumerate subdomains, IP ranges, and hostnames by using public DNS queries, zone transfer attempts, and brute forcing techniques. fierce -dns <targetDomain>
You can also specify a specific DNS server for the tool to use.fierce -dns <targetDomain> -dnsserver <targetNamserver>
We can also leverage a tool called DNSEnum to do something similar. It will look for the A records of the target domain, looks up the NS and MX records. Finally, it will attempt a zone transfer attack.dnsenum <targetDomain>
You can also specify a specific DNS server for the tool to use. Sometimes the results will differ.dnsenum <targetDomain> --dnsserver <targetNamserver>
You can use DNSEnum to brute force subdomains as well.dnsenum <targetDomain> -f <dictionaryList>
DNSMap can also be used, but it doesn’t do much other than brute-force with a built-in wordlist.dnsmap <targetDomain>
DNSRecon is an ‘all-in-one’ tool that can do most everything. dnsrecon -d <targetDomain>
Using DNSRecon to enumerate hostnames within local subnet.
We can use dnsrecon to attempt a “brute-force” attack by querying IP addresses for associated reverse lookup records.
-n : Will be the nameserver to use. -r : Will be the network “range” that you want to lookup records for.--db : Will save the found records to a SQLite DB file.
dnsrecon -n <ipAddr> -r <subnet> --db target.db
If you are unsure of any information, or even what network(s) to perform the lookup for, you can create a bash script that contains multiple commands. For example, we could create enumdns.sh that contains the following:
dnsrecon -n 10.10.10.83 -r 10.0.0.0/8 --db target.db
dnsrecon -n 10.10.10.83 -r 172.16.0.0/12 --db target.db
dnsrecon -n 10.10.10.83 -r 192.168.0.0/16 --db target.db
Running this script will enumerate all possible internal IPs for associated hostname records.
Additional Enumeration Techniques
Update your /etc/resolv.conf file so that you use the target as a DNS server. See what hostnames you can enumerate.
