4.1 : Active information gathering techniques - host & dnsrecon (Part I)

Active information gathering

Look for hidden information

Example:

• DNS Enum
• Sub-domain Enum
• DNS Zone
• Port Scanning
• OS Fingerprinting
• Banner Grabbing

host

host is better version of dig

Basic dns query

host domain # forward lookup cname,mx..
host ip     # reverse lookup

host -t $TYPE domain # specify type: mx,cname,ns...

Attempt zone transfer to dump network map

 host -l $DOMAIN $NSSERVER

Basic auto dns-zone transfer attempt dump script

#/bin/sh
for server in $(host -t ns $1 |cut -d" " -f4);do
host -l $1 $server |grep "has address"
done

dnsrecon

dnsrecon is a full dns dump, plus auto zone transfer tool.

Basic auto zone transfer

dnsrecon -d domain.com -t axfr