All language subtitles for 3. Gathering Comprehensive DNS Information

In this video we'll see how we can get comprehensive DNS information about the target Web site.

So just to give you a quick refresh on what the NSA is.

So when you type in facebook dot com a DNS server will convert that name to an IP address.

No the process is a bit more complicated.

So the DNS server contains actually a number of records each pointing to a different domain or a TV

out or to a different IP sometimes to the same IP.

So but in general you requested domain name it gets converted to an IP address and dependent on that

these information need to be stored somewhere.

So we're going to query this DNS server and see what information we can get through it.

Now we're going to use a Web site called reuptake dot com and I'm just gonna put the target Web site

that I want to get information about.

So I'm gonna type a security dot org and I'm gonna hit enter to get a report now.

As you can see we will get a big report.

So there is a lot of information in here but you can actually use the buttons in here to navigate to

any of the sections below.

So if you want to directly go to the records or to go through the FCO all you have to do is just click

in here and you'll go directly to that section what we're going to do right now though we'll go over

all the sections one by one and see what kind of information we got.

Now keep in mind the order of this information might be different but you should have the same sections

so and the analysis you can see we have general information about the target.

So you can see that it's telling us that ice security has three name servers five mail servers and one

IP address.

We can see the name servers used by ICE security and digital ocean is the hosting company that ice security

is using at the time of recording this lecture.

So this is very very useful because you can go to digital ocean right now you'll see the hosting company

and then you can pretend to be them and communicate with a security telling them that you're signing

them up for a better hosting you're giving them something because they are a VIP customer and ask them

to log in.

Obviously they'll be logging in to a fake log in page and that way you'll steal their information.

You can tell them that there is a policy change that they have to accept.

And again asked them to log in and steal the information that way.

Obviously you'll do this through a fake log in page and this is mostly social engineering.

So it's nothing to do with web site hacking and I cover all this in my social engineering course but

it's very useful because if you couldn't hack into the Web site through the applications installed then

the only way to get in is using social engineering now below this.

We can see that the target is using Google mail servers.

So they're not handling their own e-mails.

They're using Google to handle their emails.

Again you can communicate with the target pretending to be Google and get them to do something or to

log in to a fake page and steal information that way you can also see the IP address of this Web site

which can be used to discover other Web sites installed on the same server.

And this is very very useful because if you couldn't hack into your target's Web site through the applications

installed on that Web site then you can try to hack into any Web site installed on the same server.

And if you manage to do that then you can actually navigate to your target Web site because they're

all essentially installed on the same computer.

And we'll talk more about that in the next lecture and below right here we have a number of similar

domains to our target.

Now these might be completely irrelevant but you can have a look and see what you have navigating to

the quick info.

Again you can see the domain name.

You can see the TLT.

We have the IP address the name servers.

Again like I said they're useful because they usually give us information about the domain hosting company

or the hosting company hosting the Web site itself.

And we also have the mail servers like we've seen before.

It's Google Mail.

So that all can be really really useful the reverse section will perform reverse DNS lookup.

So as I said at the start of the lecture DNS is used to translate domain names into IP addresses and

the reverse lookup we use the IP address to see which domains link to this IP address.

And like I said previously this can be very very useful because we'll be able to discover other Web

sites hosted on the same server and we can hack into any of these Web sites.

And from there gain access to our target.

But with the reverse lookup you won't always get all the Web sites installed on the same server.

Therefore in the next lecture I will show you a better way of doing that.

But if you really want to see the results of the reverse lookup you'll have to log in.

So I'm actually going to open a new tab.

I'm going to go to Rob Texas again and I'm going to click on log in right here.

And the only way to log in to rob Texas right now is through Google.

So I'm going to click on Google.

I'm going to click my e-mail and that's it were logged in.

So I'm going to close this and we're going to refresh in here and if we scroll down again to the reverse

right here we have the results of the reverse lookup and you can either download this as the CSB or

view it as a hasty e-mail.

So I'm going to choose to view it as hey CML in a new tab and right here as you can see we only have

that security on its own because that security is hosted on its own server.

So there are no other Web sites installed on the same server.

But like I said if there are other Web sites hosted on the same server then you'll be able to see them

in here in the reverse lookup now going down we can see a more detailed breakdown of the DNS records

so you can see here we have information about the record.

This is the record that's used to translate the domain name into an IP address so you can see that a

security dot org links to this IP address which is the IP address of the server hosting or containing

the files of the Web site scrolling down.

We have more FCO information.

Search Engine Optimization info.

We have the Web trust reputation of this Web site.

We have the Alex our ranking and the share tab.

We have the IP of the target Web site.

Again like I said we can use this to get Web sites installed on the same server.

We have a graph representation of all the information we gathered.

We also have a history section.

This is actually very very useful because you can use this to track all the changes to the DNS info

of the target Web site so you can see when they started using Google.

You can see when they started using digital ocean as their hosting provider.

So if you scroll down we might actually be able to see that they were using a different provider.

And here you go.

We can see that they were using a different hosting company.

This one right here.

The more thing I hope I'm pronouncing that right.

But right now as we can see they changed and they switched to a different hosting company Digital Ocean.

So again you can even contact them pretending to be this company and tell them that you're going to

sign them up for a better offer or pretend that they violated one of your terms and conditions and ask

them to log in to do something when they log in you can serve them a fake file a backdoor or again use

the log in information get them to log in through a fake Web page and steal the username and password.

So information is always very very useful when it comes to hacking especially if you want to perform

a social engineering attack which might be your last resort if you could not hack into the web site

using the applications installed on it scrolling down we can see we have the WHO's information we had

a full lecture on how to get this and how this can be useful.

And finally we have the DNS block information which basically is a list of Web sites known to send spam

so usually emails sent from these Web sites would be blocked or considered as Palm.

So as you can see a very useful Web site that can be used to get information about this server used

to host the target Web site and its relationship with other Web sites other servers which hosting companies

are being used.

And like I said all of this can be very very useful whether you want to target the Web site itself whether

you want to target other Web sites or you can hack into your target Web site and even if you want to

social engineer one of the admins to gain access to your target Web site.