> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/information-gathering/active-information-gathering.md). # Active Information Gathering #### DNS Zone Transfer * Domain Name System(DNS) is a protocol that is used to resolve domain names/hostnames to IP addresses. * A DNS server \[nameserver] is like a telephone directory that contains domain names and their corresponding IP addresses. * Cloudflare (1.1.1.1) & Google (8.8.8.8) * DNS server has records. **DNS Records :** * A - Resolves a hostname or domain to an IPv4 address. * AAAA - Resolves a hostname or doamin to an IPv6 address. * NS - Reference to the domain nameserver. * MX - Resolves a domain to a mail server. * CNAME - Used for doamin aliases. * TXT - Text record * HINFO - Host information * SOA - Domain authority * SRV - Service records * PTR - Resolves an IP address to a hostname. **DNS Interrogation :** * DNS interrogation is the process of enumeration DNS records for a specific domain. * The objective of DNS interrogation is to probe a DNS server to provide us with DNS records for a specific domain. * This process can provide with important information like the IP address of a domain, subdomains, mail server addresses etc. **DNS Zone Transfer :** * In certain cases DNS server admins may want to copy or transfer zone files from one DNS to another. This process is known as a zone transfer. * If misconfigured and left unsecured, this functionality can be abused by attackers to copy the zone file from the primary DNS server to another DNS server. * A DNS Zone transfer can provide penetration testers with a holistic view of an organization's network layout. * Furthermore, in certain cases, internal network addresses maybe found on an organization's DNS servers. Zone Transfer Tools : * **dnsrecon** - it provides us with all of the dns records. ``` dnsrecon -d ``` * **dnsenum** - can essentially enumerate the records that are publicly available, used for performing dns zonetransfer automatically and DNS bruteforce ``` dnsenum ``` * Before DNS, computer would typically utilize the hosts file locate ***/etc/hosts*** * **dig** - it is a DNS lookup utility ``` dig axfr @ ``` * **fierce** - Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames agianst specified domain.(for subdomains not exactly for dns zone transfer) ``` fierce -dns ``` *** #### Host Discovery with Nmap * IP address with sub-net ``` ip a s ``` * **Nmap** - Nmap stands for *Network Mapper,* is an open-source tool for network exploration and security auditing. It scans large networks. * -sn (No port scan) only for host discovery ``` nmap -sn /24 ``` * **netdiscover** - arp request for host discovery ``` sudo netdiscover -i ``` *** #### Port Scanning with Nmap *Note:* Whenever we are dealing with windows target systems, it typically blocks ICMP pings or Ping probes, hence specify **-Pn switch**. ``` nmap -Pn -p1-65535 ``` * **Fast scan** - It scans top 100 ports ``` nmap -Pn -F ``` * **UDP port scan** -sU switch, (DNS runs on UDP ports) ``` nmap -sU ``` * To increase the **verbosity -v switch** ``` nmap -v ``` * **Service version detection** -sV switch ``` nmap -sV ``` * version for finding the exploit for that specific version. * **OS detection** : ``` nmap -O ``` * To run **default nmap script** -sC switch ``` nmap -sC ``` * **Aggressive Scan** -A switch, it combines service detection, operating detection and default script. ``` nmap -A ``` * **Timing** of scan -T<0-5>: set timing template (higher is faster). * -T0 is paranoid * -T1 is sneaky * -T2 is polite * -T3 is normal * -T4 is aggressive * -T5 is insane ``` nmap -T<0-5> ``` * *Note: -T5 is not recommended for the organization's network as it sends lots of packets.* * Timing can be used when you are having many ports to scan or many hosts to scan. * **Scan Output** : * for normal file ``` nmap -oN filename ``` * for xml format ``` nmap -oX filename ```