In this lesson, we'll discuss DNS lookups
and reverse DNS lookups, which are important tools
in the world of penetration testing.
DNS, or Domain Name System, is the protocol
that translates human-friendly hostnames
into machine-readable IP addresses,
enabling easier Internet communications.
Reverse DNS does the opposite,
meaning it just maps the IP address back to the hostname,
which is useful for network administrators
and security professionals in general.
Now, when a user enters a URL in the web browser,
a DNS Lookup is triggered.
This process involves querying the DNS servers
to resolve a hostname to its corresponding IP address,
allowing the browser to bring up the requested webpage.
The DNS resolver first contacts the DNS root server,
followed by a TLD, or Top-Level Domain server,
and the following, the authoritative DNS server,
which holds the actual IP address.
This hierarchical querying ensures that Internet traffic
can find its way from anywhere in the world
to a specific server hosting the website that you want.
Reverse DNS lookups are used kind of in the same way,
but in reverse.
They're often used for security
and network management purposes, such as verifying
where the Internet traffic originates.
This is important for systems where knowing the source
of the traffic, such as an email server,
is critical to preventing spam or unauthorized access.
The process involves querying the DNS with an IP address
to find the associated PTR (pointer) record
in the DNS zone file.
This shows the hostname linked to the IP.
Now for the exam, you will need to know how
to perform a DNS lookup and reverse DNS lookups.
To perform a DNS lookup in Linux,
you can use the dig command which is a simple tool
for interrogating DNS name servers.
Let's take a look at a simple example of a DNS lookup.
Here, the DNS lookup shown involves querying
the domain diontraining.com.
The results revealed that the domain is a CNAME
or Canonical Name for
D1K04NJD8U
HOAAL.cloudfront.net,
which indicates that Dion Training is an alias
for the CloudFront distribution at that address.
The IP addresses associated with a hostname include:
18.155.192.127,
18.155.192.63,
18.155.192.103,
and 18.155.192.119.
So we see, a hostname can contain multiple IP addresses
mapped to the same one.
Now, let's take a quick look at a reverse lookup
using dig for a Google dns server.
We simply type in dig-x
8.8.8.8, which again,
the -x portion shows we are trying
to perform a reverse lookup.
Now, as we look through the output,
we can see in the answer section
that, that address correlates to the dns.google server.
Most companies in a lot of different networks,
they use Google as a reliable, trusted source
for their DNS answers.
Now moving on, to perform DNS lookups and reverse lookups
in Windows, you will just simply use the nslookup command
followed by either the host name or the IP address.
You don't need to use any modifiers
and dig, like the -x, to specify the reverse lookup.
Windows automatically does this for us.
So if we look here, we can see the same thing
using the nslookup at www.diontraining.com.
And below that, we see another nslookup at 8.8.8.8,
which is the reverse DNS lookup.
Next, let's cover a few attacks based on the DNS servers.
DNS flood or DNS amplification are attacks pentesters
can perform to test a client's system.
The DNS flood is a type of denial-of-service
or DoS attack that overwhelms a DNS server
with excessive traffic, making it unable
to handle legitimate requests.
In a DNS amplification attack,
the attacker uses a small query
to solicit a much larger response from the DNS server,
which is then directed towards the victim's network.
By sending these small queries from spoofed IP addresses
to multiple open DNS resolvers,
the attacker can generate enormous amounts of traffic.
In 2016, the Mirai bot launched one
of the largest DNS amplification attacks.
The attack targeted the DNS provider Dyn.
Mirai used compromised IoT devices
to send massive DNS requests to Dyn's servers,
effectively overwhelming them
and disrupting Internet traffic.
This attack caused widespread Internet outages affecting
major websites like Twitter, Reddit, and even Netflix.
DNS cache poisoning, also known as DNS spoofing,
is another useful attack.
DNS cache poisoning involves inserting false DNS information
into the DNS resolver's cache
so that the subsequent request returns
an incorrect IP address
and redirects traffic to malicious websites.
In 2008, Dan Kaminsky, a security researcher,
discovered a major vulnerability,
which exposed many DNS servers to cache poisoning.
Attackers manipulated DNS responses
that would redirect users attempting
to visit popular websites, like Google or PayPal,
to malicious sites designed to steal login credentials.
DNS zone files are another DNS-related vulnerability.
A DNS zone file contains mappings between domain names
and IP addresses within a DNS namespace.
If exposed, the zone file can reveal sensitive information,
such as internal network structure, subdomains,
and IP addresses,
which attackers can exploit to plan their attacks.
Unauthorized zone transfers (AXFR) can lead to a leakage
of the entire DNS database.
For example, imagine an attacker attempts
to perform a zone transfer from a DNS server
by directly curing it for its AXFR record.
If the DNS server is not properly configured
to restrict zone transfers to trusted IPs, it will respond
with the entire zone file.
This happened in 2012, when a major DNS service provider
inadvertently allowed unauthorized zone transfers,
exposing sensitive information about all its clients.
When testing DNS for vulnerabilities,
it's essential to understand the normal behavior
of DNS queries and responses.
For instance, we can use stress-testing tools, like DNSPerf,
to simulate heavy DNS traffic
to see if the server can handle the load
and employ rate-limiting measures to mitigate the risk.
For the DNS Cache Poisoning Testing,
we can validate that the DNS server implements
transaction ID randomization
and source port randomization to prevent cache poisoning.
In a similar fashion, reverse DNS lookups
can help identify whether an IP address
associated with suspicious activity actually belongs
to the organization or an external threat actor.
So, remember, DNS translates domain names to IP addresses
for easier communication,
while reverse DNS identifies traffic sources
important for network security.
DNS is vulnerable to flood and amplification attacks
and cache poisoning, which can disrupt services
or redirect users to malicious sites.
It's vital to test DNS configurations during pentesting
to strengthen offenses against these potential attacks.