DNSRECON

DNSRECON Video Tutorial on Kali Linux : DNSRECON is best tool on Kali Linux for performing DNS Information gathering, we can gather almost each and every DNS information about our target using DNSRECON tool. We can perform different types of DNS enumerations using DNSRECON tool like standard enumeration, brute force enumeration, top level domain enumeration, Cache Snooping, DNS Zone walking etc.. We have created a DNRECON video tutorial for our users to learn how to use DNSRECON tool effectively on Kali Linux. Lets learn how to use DNSRECON tool.

DSNRECON Video Tutorial on Kali Linux

How to Navigate to DNSRECON tool in Kali Linux?

Go to Applications –> Information Gathering –> DNS Analysis –> DNSRECON

Important Options available on DNSRECON tool :

-d : This option is used to specify your target website i.e. website you want gather information about. We will see it live in dnsrecon video tutorial.

-r : This option is used to specify IP address range for reverse DNS lookups.

-t : This option is used to specify the type of enumeration we wish to perform. Along with this option we can provide several other additional options for different type of enumerations like :

For standard Enumeration : -t std

For brute force Enumeration : -t brt

For Top level domain enumeration : -t tld

For zone transfer : -t axfr

For Google Enumerations : -t goo

For Cache snooping : -t snoop -n <name_server_IP> -D <file_path>

-D : Used to provide our own custom wordlist file to brute force all sub domains. If we don’t specify this option it will pick the default.

-n : Used to provide custom name servers. If you don’t specify this it will use SOA record of your target website.

–xml, –db, -c, -j : These options are used for storing the results in a particular format i.e. XML, SQLITE, CSV, JSON respectively.

-a, -s, -z : These are additional options which can be used with standard enumeration option. We can use these option to perform mixed enumerations like -a (zone transfer with std enumeration), -s(reverse look up with std enumeration), -z (zone walk with std enumeration) etc.

Now lets see a sample DNS query for DNSRECON tool.

Sample DNSRECON Usage :

dnsrecon -d anytargetwebsite.com -t std –xml ~/Desktop/Hackingloops/newfile.xml

For cache snooping :

dnsrecon -d anytargetwebsite.com -t snoop -n <name_server> -D <Wordlist File Path> –xml <output result file.xml>

DNSRECON Video Tutorial :

If you like our dnsrecon video tutorial, don’t forget to say thanks.

Welcome friends to KYB (Know your Backtrack) Tutorial 4, today i am going to teach you another interesting DNS Information gathering tool i.e. DNSRECON Tool. DNSRECON Tool like other DNS tools used to enumerate the standard records of a domain like A, NS, SOA, MX etc. So friends lets learn all about DNSRECON Tool on Backtrack 5.

DNSRECON Tool Tutorial Hackingloops | KYB Tutorial 4

Dnsrecon KYB Tutorial 4 : Information gathering tool on Backtrack Linux

Below is the list of things that we can do using DNSRECON Tool:

Top level domain expansion ( Zone Walking and Zone Transfer)
Reverse Lookup against IP range
Perform general DNS query for NS,SOA and MX records (Standard Record Enumeration)
Cache snooping against Name Servers
Google Scanning for Sub Domains and Host

We can access DNSRECON TOOL over Backtrack by navigating below path:

Backtrack -> Information Gathering -> Network Analysis -> DNS Analysis -> dnsrecon

Lets learn each of above things in detail and how to use DNSRECON tool to achieve the same:

1. Top level domain Expansion:

First of all we all should understand what are top level domains. A top-level domain (TLD) is one of the domains at the highest level in the hierarchical Domain Name System of the Internet. For ex: In www.mywebsite.com , .com is a top level domain. Usually expansion occurs for those websites which uses country codes as their top level domains ex: .in, .uk, .au etc. As the name suggests Top level domain Expansion means to expand your domain from one region to other which is also known as Zone Transfer and in case zones are not correctly configured we can extract almost all internal records of a domain which is also known as Zone Walking. So we can use DNS Recon for multiple purposes i.e. Zone Walking and Zone Transfer. Lets understand both of them in detail i.e. How we will use DNSRECON to exploit both of these features:

a. Zone Transfer : The security problem with DNS zone transfer is that it can be used to decipher the topology of a company’s network. Specifically when a user is trying to perform a zone transfer it sends a DNS query to list all DNS information like name servers,host names,MX and CNAME records, zone serial number, Time to Live records etc. Due to the amount of information that can be obtained DNS zone transfer cannot be easily found in nowadays. However DNSRecon provides the ability to perform Zone Transfers and we can use following commands to perform Zone transfer:

./dnsrecon.py -d <mywebsite.com> -a

or you can use below command :

./dnsrecon.py -d <mywebsite.com> -t axfr

2. Reverse Lookup against IP range:

DNSRecon can perform a reverse lookup for PTR (Pointer) records against IPv4 and IPv6 address ranges.To run reverse lookup enumeration the command:

./dnsrecon.py -r <startIP>-<endIP>

For Example :

./dnsrecon.py -r 192.168.5.100-192.168.5.200

Also reverse lookup can be performed against all ranges in SPF records with the command :

./dnsrecon.py -d <domain> -s

3. Domain Brute Force Enumeration:
For performing Domain Brute force technique, we have to give a name list and it will try to resolve the A,AAA and CNAME records against the domain by trying each entry one by one.
In order to perform domain brute force attack user needs to type below command:

./dnsrecon.py -d <domain> -D <namelist> -t brt

For example:

./dnsrecon.py -d hackingloops.com -D namelist.txt -t brt

4. Cache Snooping against name servers:
DNS cache snooping happens when the DNS server has a specific DNS record cached.This DNS record will often reveal plenty of information about the name servers and other DNS information.However DNS cache snooping does not happen quite often because servers normally do not cache DNS records.
The command that can be used to perform cache snooping is as follows:

./dnsrecon.py -t snoop -n server -D <dictionary file>

For example :

./dnsrecon.py -t snoop -n <server IP address> -D dictionary.txt

5. Standard Records Enumeration:
Standard Enumeration is generally used to gather information about NameServers,SOA and MX records. In order to perform standard enumeration you can use below command:

./dnsrecon.py -d <domain>

For example:

./dnsrecon.py -d hackingloops.com

There are lot of other options that DNSRECON tool provides. It is an extremely useful tool to gather plenty of information about DNS records.

Thats all for today. If you have any doubts feel free to ask. Don’t forget to join us at Facebook in order to recent updates.