DNS (Domain Name System)
DNS plays a crucial role in the initial reconnaissance (footprinting) phase of a security assessment. It provides valuable information about a target organization’s network infrastructure.
Whois
The whois command reveals information about domain registration and ownership. Understanding the regional distribution of DNS management organizations is helpful.
| Registrar | Region |
|---|---|
| ARIN | North America |
| APNIC | Asia Pacific |
| LACNIC | Southern and Central America and Caribbean |
| RIPE NCC | Europe, the Middle East and Central Asia |
| AfriNIC | Africa |
DNS Commands
nslookup
This is the primary DNS query tool available on Windows systems. Useful options include:
type=HINFO: Retrieves additional information about the host, such as operating system, hardware, and software.type=any: Queries all available DNS record types.
dig
While nslookup is available on Unix-like systems, dig offers more advanced features and is generally preferred.
Zone Transfer
Zone transfer is a mechanism for replicating DNS data across multiple servers. However, misconfigured DNS servers can allow unauthorized zone transfers, leaking sensitive information about a domain’s internal network structure.
Example using zonetransfer.me (a site specifically designed for zone transfer testing):
- Identify the NS servers:
host -t ns zonetransfer.me
zonetransfer.me name server nsztm2.digi.ninja.
zonetransfer.me name server nsztm1.digi.ninja.
- Perform zone transfer using
host:
host -l zonetransfer.me nsztm1.digi.ninja.
Using domain server:
Name: nsztm1.digi.ninja.
Address: 81.4.108.41#53
Aliases:
zonetransfer.me has address 5.196.105.14
zonetransfer.me name server nsztm1.digi.ninja.
... (truncated output) ...
- Perform zone transfer using
dig:
dig axfr zonetransfer.me @nsztm1.digi.ninja.
; <<>> DiG 9.10.6 <<>> axfr zonetransfer.me @nsztm1.digi.ninja.
;; global options: +cmd
zonetransfer.me. 7200 IN SOA nsztm1.digi.ninja. robin.digi.ninja. 2019100801 172800 900 1209600 3600
... (truncated output) ...
DNSSEC
DNS Security Extensions (DNSSEC) enhance DNS security by adding digital signatures to DNS records. This helps prevent DNS spoofing and other attacks that compromise the integrity of DNS data.
Other Important Concepts
- Recursive Queries: A DNS resolver (e.g., your ISP’s DNS server) performs all necessary lookups on behalf of the client to find the final answer.
- Non-Recursive Queries: A DNS resolver only provides information it already knows or refers the client to another server.
This rewritten version provides a more comprehensive and informative overview of DNS, including its importance in security assessments, key commands, zone transfer vulnerabilities, and DNSSEC.