53 - DNS

Introduction

Port: 53 (TCP/UDP) There are two main reasons why Domain Name System (DNS) enumeration is essential. First, enumerating the number of domains and sub-domains can reveal how large or small the organisation is. Secondly, virtual routing may be enabled in the company's web server, responding to different web pages depending on the accessed domain.

Enumeration

There will typically be a dedicated DNS server inside an enterprise environment. In order to identify it, search for TCP or UDP port 53 on the network hosts.

nmap -n -sT -p53 <NETWORK>/<MASK>
nmap -n -sU -p53 <NETWORK>/<MASK>

Then, you can use the following commands to retrieve domains and subdomains based on IPs.

dig -x <IP> @<DNS_SERVER_IP>       # Reverse lookup
dig ANY @<DNS_SERVER_IP> <DOMAIN>  # Any information
dig axfr @<DNS_SERVER_IP> <DOMAIN> # zone transfer 
# Subdomain brute forcing
gobuster dns -d <DOMAIN> [ -r <DNS_SERVER_IP>] -w <WORDLIST.TXT>  [ -t <NUMBER_THREADS>] 
dnsrecon -t brt -d <DOMAIN> [-n <DNS_SERVER_IP>] -D <WORDLIST.txt> [ --threads <NUMBER_THREADS>]

If you want to obtain domains but you do not have an internal DNS server, you can use the tools on the OSINT section or the following commands.

dnsrecon -n 8.8.8.8 -d <DOMAIN>
dnsrecon -d <IP> -t zonewalk
dnsrecon -d <DOMAIN> -t axfr # Zone transfer
dnsrecon -r <IP>             # Reverse lookup

References

• Back to Basics: DNS Enumeration
• Pentesting DNS
• DNS Reconnaissance – DNSRecon