In this demonstration, we're going to explore
how to gather DNS information about a domain,
using two different tools: nslookup and dig.
This information can help us understand
more about the target, such as the DNS servers
and the mail servers.
First, let's look at how to use nslookup.
The nslookup command is a network administration tool
for querying the Domain Name System (DNS)
to obtain the domain name or IP address mapping.
Now, here's the command
that we're going to look up this time.
We're simply going to use diontraining.com.
So, we see here we'll receive information
from our DNS server at the IP address
of 10.21.55.1, okay,
so the non-authoritative answer,
which means that we're getting it from a source
that's not the domain owner's server.
And we have the information for diontraining.com.
So, we see the first address here is 18.244.214.8,
and we see multiple different addresseses under that.
Now, it's very common in today's environment,
especially with cloud providers,
sometimes it's even requirement
to have multiple DNS servers for a specific domain.
Now, another way we can use nslookup
is with specific query options.
Now, we're going to query the mail server this time.
Okay.
So, we see here we have the nslookup command,
and then we have the query option set equal to mx.
Notice there's no spaces there.
And then we have the www.diontraining.com.
And we simply click Enter.
So, now we're getting information
that's focusing specifically on the mail server,
the one responsible for emails.
And we also see here that it lists out
the authoritative answers,
letting us know what is the name of the server
for the one that controls the domain for diontraining.com.
Now, for diontraining.com, we are associated with AWS,
so a lot of the DNS hosting is done there,
so that's why you see the mail address starts with AWS here.
Okay, now another way people use nslookup
is typically through the interrupted prompt version.
That's what's most commonly used
that I've seen a lot of times.
So, you will simply just type in nslookup
and then put the information in that you want.
Now here, we just see the same information
that we got earlier,
but using the interrupted prompt command.
Now, also, how last time we used the query option
to get the MX records or the mail server records.
This time we're going to use the set type command.
All right, we'll type in diontraining again.
Okay, and so now we're focusing specifically
on the mail exchange servers
associated with diontraining.com.
And we see that with the non-authoritative answers,
and we see that mail exchange servers that we can use
for getting information for diontraining.com again.
Now, let's move on to dig.
The dig command is a flexible tool
for getting information about DNS name servers.
So, here's the basic command.
Okay, so we see we have a lot of information.
It's very similar to the nslookup output.
What we want to focus mostly on is the answer section.
Everything else is kind of optional information.
And we see the type of records.
So, again, we're using A records
because we're converting regular names
into IP addresses and so on and so forth.
Now, a lot of times there's different options
that we would like to add to this.
So, we can do the same thing as before.
Here, we're going to use the dig command this time
and we're going to get the MX record.
Again, this is associated with the mail servers.
Again, we'll focus on the answer and authoritative section.
We see the mail servers that are associated
with diontraining.com.
Now, another thing I want to point out with dig
is a lot of different options for the queries
to actually focus specifically
on the information that we would need.
For example, here we will use the dig command.
And now we're going to use the option short.
So here, we're only going to get the IP address
associated with diontraining.com with this short option.
And lastly, we're going to use
the reverse lookup option for dig.
So that's going to use the -x.
So the x flag is going to be set to get the reverse lookup,
meaning that we're going to input the IP address
and receive a domain name instead.
Okay, so here we have the DNS server for Google,
which is a commonly known IP address.
So, again, all we did was input the -x option,
and we input the IP address,
which gave us the domain name in return.
Now let's do this one more time with the short option.
Okay, so just for an exam tip,
we need to really focus on output to commands.
So, for example, if you see a dig command,
what does that look like
versus if you see a nslookup command?
You're not expected to be an expert on these tools,
but you need to be able to pinpoint,
"Okay, if I'm using a dig option,
the output should look something like this."
"Okay, also, if I want to use it with the short option,
what should it look like?"
Okay, now there's also another option
where we can use noall,
meaning it's going to remove all the output
and we're going to add only the answer section.
And so now we get that precise information again.
And, again, similarly with the nslookup command.
Again, understanding how these outputs look associated
with which command it's going to help you tremendously
when it comes to questions on the exam.
So, remember,
nslookup and dig are essential tools
for gathering DNS information about a domain.
They help us understand the infrastructure of the target
by providing details about the domain name
and IP address mappings, mail servers,
and also authoritative name servers.
Nslookup is a straightforward tool
used to query DNS to obtain domain name
or IP address mappings.
Dig is more flexible and detailed
for interrogating DNS name servers.
Both tools are valuable for penetration testers
to gather necessary DNS information,
helping to identify potential vulnerabilities
and understand the target's network setup.