Introduction

Dig Dug is a quick TryHackMe room focused on DNS enumeration, where the goal is to extract hidden data directly from DNS records instead of exploiting traditional services. It’s a clean, practical lab that reinforces protocol-level thinking.

Room link: https://tryhackme.com/room/digdug

Initial Reconnaissance

I started with a basic service scan to understand what was exposed on the target.

kali@kali:~$ nmap -sV 10.49.173.146
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-08 20:12 IST
Nmap scan report for 10.49.173.146
Host is up (0.027s latency).
Not shown: 999 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

From the scan alone, nothing stood out apart from SSH. Port 53 didn’t show up here, but the room description made it clear this machine was behaving like a DNS server. That mismatch was the first real signal that DNS interaction mattered more than traditional enumeration.

The description also mentioned something specific: the server only responds to a particular request for the givemetheflag.com domain. That narrowed the scope immediately.

I queried the DNS service directly using dig, pointing it at the target IP.

kali@kali:~$ dig givemetheflag.com @10.49.173.146
; <<>> DiG 9.18.39-0ubuntu0.24.04.2-Ubuntu <<>> givemetheflag.com @10.49.173.146
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61510
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;givemetheflag.com.  IN A
;; ANSWER SECTION:
givemetheflag.com. 0 IN TXT "flag{0767ccd06e79853318f25aeb08ff83e2}"
;; Query time: 30 msec
;; SERVER: 10.49.173.146#53(10.49.173.146) (UDP)
;; WHEN: Thu Jan 08 20:16:42 IST 2026
;; MSG SIZE  rcvd: 86

The response came back clean and authoritative. Instead of an A record, the server returned a TXT record containing the flag.

flag{0767ccd06e79853318f25aeb08ff83e2}

For confirmation, I repeated the same lookup using nslookup.

Both tools returned the same result, confirming the flag was stored directly in the DNS TXT record exposed by the server.

Conclusion

Dig Dug is a compact room that revolves entirely around understanding DNS behavior rather than traditional service exploitation. The challenge highlights how data can be exposed through DNS records and how a single, well-crafted query can reveal everything when the context is read correctly.

Thanks for reading this walkthrough.