DNS

TL;DR

DNS (Domain Name System). Resolves names to addresses. UDP and TCP 53. UDP serves normal queries. TCP serves zone transfers and any response over 512 bytes. A zone transfer (AXFR) is how a secondary server syncs the full zone from the primary, which is why a misconfigured one hands the whole zone to anyone who asks.

First checks: a zone transfer, the records, and subdomains. DNS enumeration needs a domain name. On a box you often guess it (bank.htb) or read it from a certificate or another service, then set $DOMAIN and add it to /etc/hosts.

Protocol background is in DNS Resolution.

Records

Enumeration

Workflow: query records with dig, try a zone transfer, then brute subdomains.

Query records.

dig any $DOMAIN @$TARGET
dig ns $DOMAIN @$TARGET
dig mx $DOMAIN @$TARGET
dig txt $DOMAIN @$TARGET
dig soa $DOMAIN @$TARGET
dig ch txt version.bind @$TARGET

@$TARGET sends the query to that server. any asks for every record type, which many servers now refuse. soa returns the admin contact and primary nameserver. ch txt version.bind asks the CHAOS-class record that leaks the BIND version when the server exposes it.

Zone transfer (AXFR). The jackpot. A misconfigured server dumps every record:

dig axfr $DOMAIN @$TARGET

axfr requests a full zone transfer: internal hostnames, IPs, and subdomains in one reply.

Brute subdomains when AXFR fails.

subfinder -d $DOMAIN -silent | dnsx -silent
puredns bruteforce wordlist.txt $DOMAIN -r resolvers.txt

subfinder pulls subdomains from passive sources. dnsx resolves a list fast. puredns brute-forces a wordlist and resolves each name against live resolvers (-r). The all-in-one classics are dnsenum $DOMAIN and dnsrecon -d $DOMAIN.

nmap.

sudo nmap -p53 -sV --script dns-recursion,dns-nsid,dns-zone-transfer --script-args dns-zone-transfer.domain=$DOMAIN -oA scans/dns $TARGET

Common misconfigurations

• Zone transfer (AXFR) allowed to any client.
• Internal records answered to external queries (split-horizon leak).
• Dynamic updates allowed without authentication.
• DNSSEC NSEC records let an attacker walk the whole zone.
• Open recursion, which enables cache poisoning and amplification.

Attack playbook

DNS is reconnaissance, not a target. Mine it to map the environment.

1. Zone transfer. dig axfr first. One misconfig dumps the whole internal namespace. Transfer any internal zones it reveals too (dig axfr internal.$DOMAIN @$TARGET), which leak domain controllers, VPN, and workstation hosts.
2. Brute subdomains. When AXFR fails, brute and resolve. New names are vhosts, dev and staging hosts, and internal services. Add each to /etc/hosts, then enumerate the web and other services on it.
3. Harvest records. MX names the mail server. TXT leaks SPF entries, keys, and verification tokens. SRV locates services (_ldap, _kerberos point to Active Directory). NS names the authoritative servers.
4. Zone walking. DNSSEC NSEC chains leak every name even without AXFR:

ldns-walk @$TARGET $DOMAIN

Practice boxes

DNS is almost always recon, not the foothold itself. The win is the hostnames and subdomains it leaks, which point you at the real target.