> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # 53 - DNS (Domain Name System) `Default Port: 53 (TCP and UDP)` DNS is often treated as background infrastructure, but it's one of the richest sources of passive recon on an engagement: subdomains, internal hostnames, mail servers, and occasionally entire zone files, all reachable without touching the actual target application. A surprising number of DNS servers are still misconfigured in ways that hand over far more than they should. > **Standard Queries** > > Asking a resolver for specific records, one at a time. Normal, expected DNS traffic that any client generates. > **Zone Transfer (AXFR)** > > Requesting the entire zone file in one go, meant only for secondary nameservers. When misconfigured to allow anyone, it leaks the whole internal DNS map at once. > [!TIP] > > Always test for an open zone transfer before doing anything else. It's a single command, and a successful one can replace an entire subdomain enumeration effort. *** ## DNS Record Types Knowing what each record type actually represents is what turns a wall of `dig` output into useful intelligence rather than noise.
Record Description
`A` Maps a hostname to an IPv4 address
`AAAA` Maps a hostname to an IPv6 address
`CNAME` Alias pointing one hostname to another
`MX` Mail server(s) responsible for the domain
`NS` Authoritative nameservers for the domain
`TXT` Free-form text, often SPF/DKIM records or domain verification strings
`SOA` Authority info: primary nameserver, admin contact, zone serial number
`PTR` Reverse mapping from an IP address back to a hostname
`SRV` Service location records, e.g. pointing to AD domain controllers
*** ## Basic Lookups ```bash theme={null} host DOMAIN # quick A record lookup dig DOMAIN # full query, more detail than host dig +short DOMAIN # just the answer, no extra formatting ``` Querying a specific record type against a specific nameserver is where `dig` becomes genuinely useful rather than just a fancier `host`: ```bash theme={null} dig NS DOMAIN @NAMESERVER # authoritative nameservers dig MX DOMAIN @NAMESERVER # mail servers dig TXT DOMAIN @NAMESERVER # SPF, DKIM, verification records dig ANY DOMAIN @NAMESERVER # request every record type at once, if the server still allows it ``` Reverse lookups go the other direction, IP to hostname, which can reveal internal naming conventions even from a single result: ```bash theme={null} dig +noall +answer -x TARGET_IP @NAMESERVER ``` > [!TIP] > > Querying the server's own version directly sometimes works and can point straight at a known CVE if the software is outdated: > > ```bash theme={null} > dig @NAMESERVER version.bind CHAOS TXT > ``` *** ## Zone Transfers (AXFR) A zone transfer is meant to replicate the full DNS zone from a primary to a secondary nameserver. If a server doesn't restrict who can request one, anyone asking gets the entire zone file back: every A record, every subdomain, every internal hostname the domain has defined. ```bash theme={null} dig axfr DOMAIN @NAMESERVER ``` `fierce` automates a broader recon pass that checks for open zone transfers as part of its normal workflow, rather than needing to test it manually against every nameserver: ```bash theme={null} fierce --domain DOMAIN ``` > [!WARNING] > > A successful AXFR is a serious misconfiguration finding on its own, it exposes the domain's entire internal structure. Report it even if nothing else comes from it directly. *** ## Subdomain Enumeration When a zone transfer isn't open, brute-forcing subdomains against a wordlist is the fallback. A few tools each take a slightly different approach. ```bash theme={null} dnsenum --dnsserver NAMESERVER --enum -p 0 -s 0 -o found_subdomains.txt -f subdomains.list DOMAIN ``` `subfinder` pulls from passive sources (certificate transparency logs, search engines, public datasets) instead of brute-forcing directly, which is faster and generates no traffic against the target's own DNS infrastructure at all: ```bash theme={null} subfinder -d DOMAIN -v ``` `subbrute` resolves a wordlist through a specific resolver list, useful when you want brute-forcing but through your own trusted resolvers rather than the target's: ```bash theme={null} echo "RESOLVER_IP" > resolvers.txt python3 subbrute.py -p DOMAIN -s names.txt -r resolvers.txt ``` > [!NOTE] > > [dnsdumpster.com](https://dnsdumpster.com/) runs a lot of this passively through a web UI and is worth checking first, it's free, requires no setup, and often surfaces subdomains and hosting providers in seconds. *** ## Reconnaissance Shortcuts A couple of quick wins worth checking alongside the standard enumeration above. ```bash theme={null} dig SOA DOMAIN @NAMESERVER ``` The SOA record's admin contact field often leaks an internal email address or naming convention, and the serial number can hint at how frequently the zone changes. ```bash theme={null} dnsrecon -d DOMAIN -t axfr,std,brt ``` `dnsrecon` bundles standard lookups, zone transfer testing, and brute-forcing into a single pass, a reasonable one-command starting point before reaching for the more specialized tools above. *** ## DNS Poisoning (Local Network) > [!WARNING] > > This actively intercepts and redirects live traffic for other users on the network. It's a disruptive, high-impact technique, confirm scope explicitly covers it before running it. DNS spoofing on a local network answers a victim's DNS query before the real server can, redirecting them to an attacker-controlled IP instead. `ettercap` bundles this into a plugin rather than needing a custom responder. **1. Define the spoofed records** Edit ettercap's DNS config file to map the target domain to your IP: ```bash theme={null} sudo vim /etc/ettercap/etter.dns ``` ```text theme={null} DOMAIN.com A ATTACKER_IP *.DOMAIN.com A ATTACKER_IP ``` **2. Scan for hosts** Launch `ettercap`, then go to **Hosts → Scan for Hosts** to find live targets on the network. **3. Set the targets** Add the victim's IP as **Target1** and the default gateway's IP as **Target2**, positioning yourself for a man-in-the-middle between the two. **4. Enable DNS spoofing** Go to **Plugins → Manage Plugins** and activate `dns_spoof`. From here, any DNS query from the victim matching your configured domains resolves to your IP instead of the real one. *** ## Subdomain Takeover When a subdomain's DNS record (usually a CNAME) still points to a third-party service, like a cloud platform or SaaS product, that's no longer claimed, registering that resource on the provider's side lets you serve content from the victim's own subdomain. ```bash theme={null} dig CNAME SUBDOMAIN.DOMAIN @NAMESERVER ``` A CNAME pointing to an unclaimed GitHub Pages site, an unused S3 bucket, or a deprovisioned SaaS app are all classic signs worth following up on manually. > [!NOTE] > > [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) catalogs which services are currently vulnerable to takeover and the exact fingerprint to look for in each case, essential reference once you've found a dangling CNAME. *** ## Quick Reference Tools > **[Hackviser: DNS](https://hackviser.com/tactics/pentesting/services/dns)** > > Quick-reference pentesting guide for the DNS service. > **[HackTricks: DNS](https://hacktricks.wiki/en/network-services-pentesting/pentesting-dns.html)** > > Deeper breakdown of DNS enumeration and attack techniques. > **[dnsdumpster.com](https://dnsdumpster.com/)** > > Free passive DNS reconnaissance tool, good first stop before active enumeration. > **[can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz)** > > Reference for identifying subdomain takeover vulnerabilities by service. > [!WARNING] > > DNS spoofing and aggressive zone brute-forcing both generate significant, easily noticed traffic. Confirm scope and rules of engagement before running either against a live target. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.