My tried and tested tips and tricks for DNS Reconnaissance for beginners
Greetings, Cyber Mavericks!
Welcome back to our DNS reconnaissance series! In this follow-up article, I’m going to share with you some practical tips and tricks to enhance your DNS enumeration skills.
Whether you’re a beginner or seeking to refine your knowledge of DNS reconnaissance, these tips are aimed at helping you with your enumeration journey.
If you haven’t done so already, be sure to check out the first article in the series:
A Beginner’s Guide to DNS Reconnaissance (Part 1)
Let’s explore some fundamental DNS enumeration tips and strategies to increase your proficiency in this essential aspect of reconnaissance as part of your ethical hacking endeavors.
Here are my 10 basic tips for starting out your DNS reconnaissance efforts:
1. Basics first!
If you haven’t done so already, I highly recommend gaining a basic understanding of the DNS protocol and all of its different options and record types before you dive into using various tools.
I have covered a short introduction to DNS in my first article “A Beginner’s Guide to DNS Reconnaissance (Part 1)”. If you want to dive deeper into DNS protocol and enumeration, I recommend checking out the additional resources I have listed in the Further Reading section of that article.
2. Use a variety of tools
Different DNS enumeration tools have different strengths and weaknesses, so it’s important to use a variety of tools to get a more complete picture of a target’s DNS infrastructure.
Experiment with the tools in this article and keep discovering others to find the ones that work best for you.
3. Look for DNS records in unconventional places
In addition to standard DNS records such as A, MX, and NS records, also check for less commonly used DNS records such as SRV, TXT, and CNAME records.
These records can often reveal additional information about a target’s infrastructure and services.
We will be exploring that in more detail in the next article covering more advanced DNS enumeration techniques.
4. Leverage search engines and DNS databases
Use search engines and DNS databases to discover subdomains that may not be immediately apparent.
Many organizations have subdomains that are not linked to their main website, so it can be beneficial to look up the target domain on sites like crt.sh and VirusTotal, which can provide a list of subdomains associated with the domain.
More on this soon in Part 2 of this series.
5. Keep track of your results
DNS enumeration can result in a large amount of data, so it’s important to keep track of your results in an organized manner.
Create a spreadsheet or database to store the subdomains, IP addresses, and other information you discover during enumeration. This can make it easier to analyze the data and identify potential exposures and vulnerabilities.
6. Increase your Linux-fu
Linux regular expressions and text manipulation tools are crucial for organizing DNS enumeration output files and collating them because they allow for quick and efficient parsing of complex and large amounts of data.
Sure, you can use Excel spreadsheets for this but you will run into problems when your data sets are too large. Using regular expressions, you can easily extract specific patterns or information from DNS enumeration output files, such as IP addresses or hostnames.
Tools such as cut, grep, sed, awk, diff, uniq, and sort are also useful for filtering, searching, replacing, and sorting through large amounts of data. By mastering these tools, you can better analyze and make sense of your DNS enumeration results.
7. Avoid overloading the target’s DNS servers
DNS enumeration can be resource-intensive and can potentially cause problems for the target’s DNS servers.
To avoid overloading the servers, limit the rate or “threads” of your DNS queries and take breaks between enumeration sessions.
Remember to top up your coffee!
8. Use wildcard subdomains
In some cases, a website owner may configure their DNS server to respond to any subdomain that doesn’t exist with a wildcard DNS record. This means that any query for a non-existent subdomain will be resolved to the same IP address.
You can take advantage of this by using tools like Sublist3r or Amass to generate a large list of potential subdomains based on a target domain and then filter out the valid subdomains using tools like Masscan.
9. Broaden your search, then sharpen your aim
Start with a wide scope and then refine your search, this will ensure that you don’t miss any potential targets while still focusing your efforts where they matter most.
Cast a wide net, then reel in the catch.
One example is starting with Whois and Forward DNS resolution of all domain names, then Reverse IP lookup of all IP addresses you get.
You may find that some of those ranges belong to cloud providers such as Azure and AWS (see Further Reading) and as such, you might want to isolate them from further reconnaissance or penetration testing stages as they might not belong to your target.
10. Coffee makes you understand The Matrix…..
Sorry, I had no 10th tip! But seriously, caffeine is the key ingredient to successful hacking. 😉
Mastering DNS enumeration is essential for effective reconnaissance in penetration testing. By incorporating these practical tips and tricks into your toolkit, you can enhance your skills and uncover valuable insights about target domains.
Whether you’re a beginner or an experienced professional, continuous learning and exploration are key to staying ahead in cybersecurity and ethical hacking.
Happy enumerating, and may your reconnaissance endeavors be fruitful and rewarding!