DNS
DNS is the phone book of the internet — and a misconfigured DNS server will happily read you every entry, including the ones meant to stay internal. Zone transfers, version disclosure, and subdomain brute-forcing turn a name server into a map of the target’s infrastructure.
Protocol: UDP (sometimes TCP) · Port: 53
What Is DNS?
DNS (Domain Name System) resolves computer names into IP addresses. There’s no central database — it’s a massive distributed system, like a library full of phone books where each server is responsible for its own section and refers you elsewhere for the rest. DNS is mostly unencrypted, which means queries can be intercepted and spied on. That privacy gap drove the creation of encrypted variants you’ll occasionally encounter: DNS over TLS (DoT), DNS over HTTPS (DoH), and DNSCrypt.Default Configuration
All DNS servers work with three types of configuration files:- Local DNS configuration files
- Zone files
- Reverse name resolution files
named.conf.localnamed.conf.optionsnamed.conf.log
Local DNS Configuration
Thenamed.conf files define the server’s zones and behavior. A typical local zone definition looks like this:
Zone Files
A zone file describes a zone completely. It must contain exactly one SOA (Start of Authority) record and at least one NS (Name Server) record. The SOA record sits at the top:Reverse Name Resolution Zone Files
For an IP address to be resolved back to its Fully Qualified Domain Name (FQDN), the DNS server needs a reverse lookup file. These usePTR records mapping addresses back to names:
Dangerous Settings
A DNS server can be attacked in many ways. Known vulnerabilities for BIND9 are catalogued at CVEdetails, and SecurityTrails maintains a list of the most popular DNS attack types. The settings most relevant to a pentester are the ones that control who is allowed to query, transfer, and update zones:Footprinting the Service
Footprinting DNS is all about the requests you send and what the server is willing to disclose in response. The workhorse tool isdig.
NS Query — Find the Name Servers
Start by asking the server which name servers it knows about. TheNS record reveals them, and the @ character specifies which DNS server to query:
Version Query
Sometimes you can fish the server’s version out of a CHAOS class, TXT type query. The entry has to exist on the server for this to work, but when it does, it’s free version intel for CVE matching:ANY Query — Show Everything
TheANY option asks the server to return every record it’s willing to disclose. Note that not all entries from a zone will necessarily show up:
AXFR Zone Transfer — The Jackpot
A zone transfer copies a zone from one server to another, normally over TCP port 53. The procedure is abbreviated AXFR (Asynchronous Full Transfer Zone). Servers normally authenticate each other with a shared secret (therndc-key you’d see in the config), but if allow-transfer is misconfigured, anyone can request the whole zone:
AXFR Across Subdomains
If the administrator setallow-transfer to a subnet or to any, you can query the entire zone file — and pivot to other zones, which may expose internal IP addresses and hostnames you wouldn’t otherwise see:
Subdomain Brute-Forcing
When zone transfer is locked down, you can still discover individualA records by brute-forcing hostnames against a wordlist. SecLists provides good ones.
A simple Bash for-loop sends a query per candidate and keeps the hits:
Quick Reference
The footprinting flow: NS query → version query → ANY query → attempt AXFR → fall back to subdomain brute-forcing if AXFR is refused.
Next: FTP — anonymous logins, banner grabbing, and pulling files off misconfigured file servers.