All language subtitles for 007 DNS Information (OBJ 2.1)

Instructor: There is a lot of information

you can gather from the Domain Name System.

Now we're gonna talk about

each of the different record types

that we have inside of DNS,

and the purpose of DNS,

but we're not gonna do a really deep,

deep dive here,

because you should already know this information

from back in your network plus studies.

If you don't, please go back,

and review this type of information,

because again, information from Network Plus

and Security Plus is considered assumed knowledge

at this level when you're taking PenTest+

and you're getting ready for your exam.

Now, when we talk about the Domain Name System

or DNS, it's really a system

that's used to allow you

to access a network client

by using a human readable host name

instead of using its numeric IP address.

For example, if you want to visit my website,

you can simply type in DionTraining.com

into your web browser and in the background,

your computer is gonna translate that

into whatever IP address

is hosting my server right now.

Now, that's all done

because there's an A record that is associated

with DionTraining.com

and that is spread around the internet

through all of the DNS servers

so everybody can know how to access it.

Now, when we talk about domain names,

there is a lot of critical information in here

that you can get.

As you look at the domain names,

you're gonna be able to see

a lot of different records,

and a lot of sub domains and domains

that are associated with

a particular domain name like DionTraining.com.

For example, if you go and look at

all of the DNS records

that are out there for DionTraining.com,

you'll see we have a bunch of different

types starting with an A-record.

Now, an A-record stands for an address record,

and an A-record is used to link a host name

to an IPV4 address.

If you're using IPV6,

we have what's called four-A record,

and it's written as AAAA,

and this links directly to an IPV6 address

instead of an IPV4 address.

Either way, when you're using an A record

or a four-A record,

you are linking a human readable name

to an IP address either in IPV4 or IPV6.

Now, another way that we can link

a human readable address

to a server is by using a CNAME record.

Now, a CNAME record stands for

the Canonical Name Record,

and this is used instead of an A-record

or a four-A record if you wanna point to

a domain name

to another domain name

or sub domain instead of having to point it

to an actual IP address.

For example, I have many

different website domains

that I've bought and used over the years,

and some of them we don't use anymore,

but we still link them

back to our main Dion Training website,

so that way if somebody uses the old domain name,

it'll redirect them automatically

to our new current domain name.

And to do this, we use CNAME Records.

For example,

I own a website domain called itil4exam.com.

If you type in itil4exam.com

it will automatically redirect you

right back to DionTraining.com

because I have a CNAME Record

set up @itil4exam.com.

That points directly to DionTraining.com.

The next type we have is known as an MX record.

Now, an MX record is a Mail Exchange Record,

and we use this to direct emails

to a mail server.

This can be used to indicate how email messages

should be routed around the internet

when you're using

the Simple Mail Transfer Protocol or SMTP.

When we use a Mail Exchange Record,

we're actually pointing to another domain name,

and not an IP address.

For example, if you look up DionTraining.com,

and you look at our mail records,

you're gonna see they're actually pointing

to Google's mail servers

because they run the email

for DionTraining.com.

Next, we have an SOA Record,

which stands for the Start of Authority.

Now, this record is used to store

important information about

a domain name or a zone,

and a zone is really all of the information

about a given domain name

including its a records,

CNAME Records, MX records,

and other types of records.

When we're talking about an SOA Record,

we're basically saying who is responsible

for this domain name?

In the case of my website, DionTraining.com,

we are responsible for it,

and so our Start of Authority Record

tells everybody that our server

is gonna be the authoritative server

for the domain name at any of the records.

The way DNS works, if you think back

to your earlier studies is that there is

a central server for any domain name,

but that one server

doesn't make all the requests

for everyone in the world,

so instead, it creates the official records,

and the distributes those out to other places,

and so we have to know who is the person

who's authorized to make changes,

and distribute the original new copy

that goes out to everybody else around the world,

and that's what an SOA Record does.

Next, we have pointer records,

which are written as PTR.

Now, a Pointer Record

is used to correlate an IP address

with a domain name,

and this is basically the opposite

of an A-Record.

With an A record, we went from host name

to IP address.

For a Pointer Record,

we're going from IP address to host name.

This is always stored under

the format of .RPA which is the top-level

domain we use when we're dealing

with these Pointer Records.

The next type of record we have

is known as a text record or TXT record.

Now, a Text Record

is used by domain administrators.

Adds text into the domain name system.

Now, this allows us to have machine-readable data

that's added into records,

and we do this

for all sorts of different reasons,

including being able to say

that this domain is authorized

by me to allow some other service

to use my domain name.

For example, if you send an email

to support@DionTraining.com,

it's actually not going to my email servers,

it's actually going into my support system,

and that support system

has been given permission to send emails

on behalf of DionTraining.com

by having a special text record

that shows I authoritatively own this domain,

and I've given permission

to that service to send emails on my behalf.

Next, we have a service record

which is known as an SRV record.

These are used to specify a host

and a port for specific service.

For example, I can specify a port

and an IP address that's gonna be used

for a chat server by using a service record

or if I wanna set up something for VoIP services,

I can do that with a service record as well.

Finally, we have an NS Record.

This is the last record we're gonna talk about.

Now, an NS Record is a name server record.

This is used to indicate which DNS name server

is going to be the accurate one for the domain.

Let's say for example,

you decide to host a new blog,

and you decide to buy a new website

with a new domain name.

Wherever you bought that,

will normally serve as your name server,

but you may wanna switch that

to a different provider later on,

and so you might go from GoDaddy

to Google Domains,

and you're gonna have to change

your NS records to say Google Domains

is now the correct place for my domain names.

Now that we've covered the basics of DNS,

and the different record types we have,

we need to talk a little bit more about DNS,

and how you're gonna use it

as a penetration tester.

Now, as a penetration tester

in the reconnaissance phase,

one of the things I wanna do

is pull up all of your DNS records,

and look at them,

because that's gonna give me addresses

for servers whether in the host name form,

or an IP address,

as well as being able to see

what kind of services you may be using.

For example, if you looked up DionTraining.com

you're gonna be able to see

what type of web server we have,

what type of email server we have.

What type of record server

we're using for all of our domain names,

What kind of services we might be using

that are third party to us,

like software as a service cloud-based tools,

like Freshdesk for our support desk.

Slack for our communications.

And other things like that.

All of this can be found

from those different records types.

Specifically, you wanna focus on the MX records

for any kind of email services,

as well as the text records,

and service records

to be able to see any third party software

as a service type solutions

that that person may be using.

Now, when you look at these DNS records

you're gonna find all sorts

of great additional targets

that you can actually look at

that you may not have discovered otherwise,

so it's a good place

to do your reconnaissance at.

Now, to look at these DNS records,

you have to use a tool to do that,

and you're gonna query those records

and be able to see the information

inside of them by using these different tools.

Now, one of the most common tools

that's used is known as nslookup.

Nslookup is a cross-platform tool

that operates on Windows, Linux and Mac systems,

and allows you to query a domain name server,

and then get information back

in the form of those different record types.

Some other tools you can use

for this purpose are things like Dig and Host.

Like I said, there's lots of different ways

to query these records

but these are some of the most common

command line tools.

Now, when you're querying these records,

you do wanna gather that information

as part of your open source intelligence,

and add it into your Wiki or your spreadsheet

for all the data you've been collecting

because these are all potential targets

depending on the size,

and scope of your engagement.

Now, in addition to finding out

this technical information

inside of your DNS records,

you can also find out information

about the domain and who owns it.

To do this, we're gonna use a tool

known as Whois.

Now Whois is a command line tool

on Linux Systems, but it also exists as a website

that you can go and use

to actually pull this information.

Now, when you pull up a typical Whois record,

you're gonna get a lot of information in there,

including who registered that domain name.

The name and address of the organization.

Who owns that domain.

The email address and phone numbers

of the person who registered that domain,

As well as the technical points of contacts.

Billing points of contacts,

and other administrative points of contacts.

Additionally, you're gonna be able to figure out

who the domain's registrar is,

which could be something

you might want to use inside of

a spear-phishing campaign or a phishing campaign

because you can send emails

pretending to be that registrar.

In addition to all this,

you'll also find out the status of the domain,

which means you'll be able to figure out

when it is up for renewal, deletion,

transfer or other related information,

And finally, you'll figure out

what are the name servers

that are being used by that domain.

With those name server records,

you can actually conduct

a zone transfer of the DNS records

from the name server onto your local machine

so you can analyze them offline as well.

This is another way

that people do this in reconnaissance,

but that is more of an active phase

than a passive phase

because you're now touching

somebody else's server.

Now, one of the things I do wanna mention

about the Whois information is that it's not

nearly as valuable these days as it used to be.

In the old days, there was no privacy protections

for the information in a Whois database.

It was all public source open knowledge

that anybody could look at,

but these days,

people can pay a little bit extra

to have their information kept private,

and by doing that,

the organization will have it say,

privacy blocked when you're looking

for the email, phone number

or names associated with a given record.

Even though that's the case,

it's still good idea to look at

the Whois Records

because some people are too cheap

to pay for that privacy,

and there's other ways to find that information

out by linking with other sources

of open-source intelligence

that you can then find online.

(logo chimes)