# 6. DNS Footprinting

{% embed url="<https://youtu.be/PvDS1ZBFPwk>" %}
DNS Enumeration
{% endembed %}

## 1. Gather DNS Information using nslookup Command Line Utility and Online Tool

### Command line in Windows

```
nslookup // Enter interactive mode
```

Now to search for any records, set the type

```
set type=a
set type=cname  //cname record are always from authoritative server
```

Now enter the website name to get the records

```
www.certifiedhacker.com
```

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FQdsW6lPIJf29aeYX6fLL%2Fimage.png?alt=media&#x26;token=b98aa549-e9ad-47f6-a9be-ed826e3fe977" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FbERYtc0x26nwgmVL2O56%2Fimage.png?alt=media&#x26;token=3f62e1a4-8e1d-4b29-82da-2296a950d6cd" alt=""><figcaption></figcaption></figure>

### Online nslookup

{% embed url="<http://www.kloth.net/services/nslookup.php>" %}

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2Fgki41F3arch6RbdN4DTD%2Fimage.png?alt=media&#x26;token=43d9d467-f484-4e55-9c19-f926e28a3c40" alt=""><figcaption></figcaption></figure>

### **Other tools**

* dig
* host

```
host cavementech.com
cavementech.com has address 198.37.123.126
cavementech.com mail is handled by 0 cavementech.com.o
```

#### Zone Transfer with dig

```
─[✗]─[user@parrot]─[~]
└──╼ $dig axfr @nsztm1.digi.ninja zonetransfer.me

; <<>> DiG 9.18.11-2~bpo11+1-Debian <<>> axfr @nsztm1.digi.ninja zonetransfer.me
; (1 server found)
;; global options: +cmd
zonetransfer.me.	7200	IN	SOA	nsztm1.digi.ninja. robin.digi.ninja. 2019100801 172800 900 1209600 3600
zonetransfer.me.	300	IN	HINFO	"Casio fx-700G" "Windows XP"
zonetransfer.me.	301	IN	TXT	"google-site-verification=tyP28J7JAUHA9fw2sHXMgcCC0I6XBmmoVi04VlMewxA"
zonetransfer.me.	7200	IN	MX	0 ASPMX.L.GOOGLE.COM.
zonetransfer.me.	7200	IN	MX	10 ALT1.ASPMX.L.GOOGLE.COM.
zonetransfer.me.	7200	IN	MX	10 ALT2.ASPMX.L.GOOGLE.COM.
zonetransfer.me.	7200	IN	MX	20 ASPMX2.GOOGLEMAIL.COM.
zonetransfer.me.	7200	IN	MX	20 ASPMX3.GOOGLEMAIL.COM.
zonetransfer.me.	7200	IN	MX	20 ASPMX4.GOOGLEMAIL.COM.
zonetransfer.me.	7200	IN	MX	20 ASPMX5.GOOGLEMAIL.COM.
zonetransfer.me.	7200	IN	A	5.196.105.14
zonetransfer.me.	7200	IN	NS	nsztm1.digi.ninja.

```

## <mark style="color:red;">2. Reverse DNS</mark>

{% embed url="<https://www.yougetsignal.com/>" %}

```
$host 198.37.123.126
;; communications error to 192.168.18.1#53: timed out
126.123.37.198.in-addr.arpa domain name pointer server902.vebhost.com.
```

### DNSRECON

Install dnsrecon (used for DNS Brute forcing)

```
sudo apt install dnsrecon
```

```
./dnsrecon.py -r <startIP-endIP>
```

## <mark style="color:red;">3. Subdomains and DNS using security trails</mark>

{% embed url="<https://securitytrails.com/>" %}

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2F0k4fijMVml4EmVuRzCEJ%2Fimage.png?alt=media&#x26;token=edc79e67-f6ca-4320-ab3a-61890c00a1ce" alt=""><figcaption></figcaption></figure>

**Other tools**

{% embed url="<https://dnschecker.org/>" %}

{% embed url="<https://dnsdumpster.com/>" %}

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FZ9cLykzpKm0n9z8VWBlr%2Fimage.png?alt=media&#x26;token=60c2f602-ddf0-4dac-b978-799b327ee2ee" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">4. DNS Cache on Windows</mark>

```

C:\Users\Ammar>ipconfig /displaydns

Windows IP Configuration

    virus-alert-center.com
    ----------------------------------------
    No records of type AAAA


    virus-alert-center.com
    ----------------------------------------
    Record Name . . . . . : virus-alert-center.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 0
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 127.0.0.1


    ultracodec.com
    ----------------------------------------
    No records of type AAAA
```

### Best CEH Practical Preparation Course

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}