hacktricks/network-services-pentesting/pentesting-dns.md

320 lines
16 KiB
Markdown
Raw Normal View History

# 53 - Pentesting DNS
2022-04-28 16:01:33 +00:00
<details>
2024-02-10 13:11:20 +00:00
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
2022-04-28 16:01:33 +00:00
2024-02-10 13:11:20 +00:00
Drugi načini podrške HackTricks-u:
2024-01-03 10:42:55 +00:00
* Ako želite da vidite **vašu kompaniju reklamiranu na HackTricks-u** ili **preuzmete HackTricks u PDF formatu** proverite [**PLANOVE ZA PRIJATELJSTVO**](https://github.com/sponsors/carlospolop)!
2024-02-10 13:11:20 +00:00
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Otkrijte [**Porodicu PEASS**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili nas **pratite** na **Twitteru** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
2024-02-10 13:11:20 +00:00
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.
2022-04-28 16:01:33 +00:00
</details>
<figure><img src="../.gitbook/assets/image (2) (1).png" alt=""><figcaption></figcaption></figure>
**Trenutno dostupno podešavanje za procenu ranjivosti & testiranje proboja**. Pokrenite kompletan pentest od bilo kog mesta sa 20+ alata i funkcija koje idu od izviđanja do izveštavanja. Mi ne zamenjujemo pentestere - mi razvijamo prilagođene alate, module za detekciju & eksploataciju kako bismo im vratili neko vreme da dublje kopaju, otvaraju školjke i zabavljaju se.
2024-01-11 13:18:30 +00:00
{% embed url="https://pentest-tools.com/" %}
## **Osnovne Informacije**
**Sistem za Imena Domena (DNS)** služi kao direktorijum interneta, omogućavajući korisnicima pristup veb sajtovima putem **lako pamtljivih imena domena** poput google.com ili facebook.com, umesto numeričkih Internet Protokol (IP) adresa. Prevodeći imena domena u IP adrese, DNS osigurava da veb pregledači brzo mogu učitati internet resurse, pojednostavljujući način na koji se krećemo po online svetu.
2024-02-10 13:11:20 +00:00
**Podrazumevani port:** 53
```
PORT STATE SERVICE REASON
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
5353/udp open zeroconf udp-response
53/udp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
```
2024-02-10 13:11:20 +00:00
### Različiti DNS serveri
* **DNS Root Serveri**: Nalaze se na vrhu DNS hijerarhije, upravljajući top-level domenima i intervenišu samo ako niži nivo serveri ne odgovore. Internet korporacija za dodeljivanje imena i brojeva (**ICANN**) nadgleda njihov rad, sa globalnim brojem od 13.
* **Autoritativni Nameserveri**: Ovi serveri imaju poslednju reč za upite u svojim određenim zonama, pružajući definitivne odgovore. Ako ne mogu pružiti odgovor, upit se eskalira ka root serverima.
* **Neautoritativni Nameserveri**: Bez vlasništva nad DNS zonama, ovi serveri prikupljaju informacije o domenima putem upita drugim serverima.
* **Caching DNS Server**: Ovaj tip servera pamti prethodne odgovore na upite tokom određenog vremena kako bi ubrzao vreme odgovora za buduće zahteve, pri čemu trajanje keša diktira autoritativni server.
* **Forwarding Server**: Obavljajući jednostavnu ulogu, forwarding serveri jednostavno prosleđuju upite drugom serveru.
* **Resolver**: Integrisani u računare ili rutere, resolveri izvršavaju lokalnu rezoluciju imena i nisu smatrani autoritativnima.
2022-10-02 19:15:35 +00:00
2024-02-10 13:11:20 +00:00
## Enumeracija
2022-10-02 19:15:35 +00:00
### **Banner Grabbing**
Nema banera u DNS-u, ali možete dohvatiti magični upit za `version.bind. CHAOS TXT` koji će raditi na većini BIND nameservera.\
2024-02-10 13:11:20 +00:00
Možete izvršiti ovaj upit koristeći `dig`:
```bash
dig version.bind CHAOS TXT @DNS
```
Takođe, alat `fpdns` može identifikovati server.
2024-02-10 13:11:20 +00:00
Takođe je moguće dobiti baner i sa **nmap** skriptom:
```
--script dns-nsid
```
2024-02-10 13:11:20 +00:00
### **Bilo koji zapis**
Zapis **ANY** će zatražiti od DNS servera da **vrati** sve dostupne **unose** koje **je spreman da otkrije**.
2022-10-02 19:15:35 +00:00
```bash
dig any victim.com @<DNS_IP>
```
### **Zonski transfer**
2022-10-02 19:15:35 +00:00
2024-02-10 13:11:20 +00:00
Ovaj postupak je skraćen kao `Asinhroni potpuni transfer zone` (`AXFR`).
```bash
dig axfr @<DNS_IP> #Try zone transfer without domain
dig axfr @<DNS_IP> <DOMAIN> #Try zone transfer guessing the domain
2021-06-20 12:09:34 +00:00
fierce --domain <DOMAIN> --dns-servers <DNS_IP> #Will try toperform a zone transfer against every authoritative name server and if this doesn'twork, will launch a dictionary attack
```
2024-02-10 13:11:20 +00:00
### Više informacija
```bash
dig ANY @<DNS_IP> <DOMAIN> #Any information
dig A @<DNS_IP> <DOMAIN> #Regular DNS request
dig AAAA @<DNS_IP> <DOMAIN> #IPv6 DNS request
dig TXT @<DNS_IP> <DOMAIN> #Information
dig MX @<DNS_IP> <DOMAIN> #Emails related
dig NS @<DNS_IP> <DOMAIN> #DNS that resolves that name
dig -x 192.168.0.2 @<DNS_IP> #Reverse lookup
dig -x 2a00:1450:400c:c06::93 @<DNS_IP> #reverse IPv6 lookup
#Use [-p PORT] or -6 (to use ivp6 address of dns)
```
2024-02-10 13:11:20 +00:00
#### Automatizacija
2023-08-15 08:09:34 +00:00
```bash
for sub in $(cat <WORDLIST>);do dig $sub.<DOMAIN> @<DNS_IP> | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done
2023-08-15 08:09:34 +00:00
dnsenum --dnsserver <DNS_IP> --enum -p 0 -s 0 -o subdomains.txt -f <WORDLIST> <DOMAIN>
```
2024-02-10 13:11:20 +00:00
#### Korišćenje nslookup-a
```bash
nslookup
> SERVER <IP_DNS> #Select dns server
> 127.0.0.1 #Reverse lookup of 127.0.0.1, maybe...
> <IP_MACHINE> #Reverse lookup of a machine, maybe...
```
2024-02-10 13:11:20 +00:00
### Korisni metasploit moduli
```bash
auxiliary/gather/enum_dns #Perform enumeration actions
```
2024-02-10 13:11:20 +00:00
### Korisni nmap skriptovi
```bash
#Perform enumeration actions
nmap -n --script "(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport" <IP>
```
### DNS - Obrnuti BF
```bash
dnsrecon -r 127.0.0.0/24 -n <IP_DNS> #DNS reverse of all of the addresses
dnsrecon -r 127.0.1.0/24 -n <IP_DNS> #DNS reverse of all of the addresses
dnsrecon -r <IP_DNS>/24 -n <IP_DNS> #DNS reverse of all of the addresses
dnsrecon -d active.htb -a -n <IP_DNS> #Zone transfer
```
2021-04-02 19:21:43 +00:00
{% hint style="info" %}
Ako uspete da pronađete poddomene koje se prevode u interne IP adrese, trebalo bi da pokušate da izvršite reverzni DNS BF ka NSs domena tražeći taj IP opseg.
2021-04-02 19:21:43 +00:00
{% endhint %}
2024-02-10 13:11:20 +00:00
Još jedan alat za to: [https://github.com/amine7536/reverse-scan](https://github.com/amine7536/reverse-scan)
Možete upitati reverzne IP opsege na [https://bgp.he.net/net/205.166.76.0/24#\_dns](https://bgp.he.net/net/205.166.76.0/24#\_dns) (ovaj alat takođe pomaže sa BGP).
### DNS - Subdomeni BF
```bash
2022-10-02 19:15:35 +00:00
dnsenum --dnsserver <IP_DNS> --enum -p 0 -s 0 -o subdomains.txt -f subdomains-1000.txt <DOMAIN>
dnsrecon -D subdomains-1000.txt -d <DOMAIN> -n <IP_DNS>
dnscan -d <domain> -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
```
2024-02-10 13:11:20 +00:00
### Serveri Active Directory-ja
2023-11-03 01:17:04 +00:00
```bash
dig -t _gc._tcp.lab.domain.com
dig -t _ldap._tcp.lab.domain.com
dig -t _kerberos._tcp.lab.domain.com
dig -t _kpasswd._tcp.lab.domain.com
2023-11-03 01:17:04 +00:00
nslookup -type=srv _kerberos._tcp.<CLIENT_DOMAIN>
nslookup -type=srv _kerberos._tcp.domain.com
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='domain.com'"
```
2022-10-02 19:15:35 +00:00
### DNSSec
```bash
2024-02-10 13:11:20 +00:00
#Query paypal subdomains to ns3.isc-sns.info
nmap -sSU -p53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=paypal.com ns3.isc-sns.info
```
2022-10-02 19:15:35 +00:00
### IPv6
2024-02-10 13:11:20 +00:00
Bruteforsiranje korišćenjem "AAAA" zahteva za prikupljanje IPv6 adresa poddomena.
```bash
dnsdict6 -s -t <domain>
```
## Bruteforce reverse DNS in using IPv6 addresses
### Introduction
2024-02-10 13:11:20 +00:00
When pentesting, it is common to encounter IPv6 addresses that do not have reverse DNS records associated with them. This can be a potential security risk as it may allow an attacker to gather information about the target network. In such cases, bruteforcing reverse DNS can be a useful technique to uncover additional information.
### Steps to bruteforce reverse DNS using IPv6 addresses
1. **Enumerate IPv6 addresses**: Use tools like `nmap` or `masscan` to enumerate IPv6 addresses within the target network.
2024-02-10 13:11:20 +00:00
2. **Generate possible domain names**: Since reverse DNS records are based on domain names, generate a list of possible domain names that could be associated with the IPv6 addresses. This can include variations of the target domain, subdomains, or common naming conventions used by the organization.
3. **Bruteforce reverse DNS**: Utilize tools like `dnsrecon` or `dnsenum` to bruteforce reverse DNS records for the enumerated IPv6 addresses using the generated list of domain names. These tools can automate the process of querying DNS servers for reverse DNS records associated with the IPv6 addresses.
4. **Analyze results**: Review the results of the bruteforcing process to identify any potential misconfigurations or security vulnerabilities related to reverse DNS records. This information can be valuable for further enumeration and exploitation during the pentest.
By following these steps, pentesters can effectively bruteforce reverse DNS using IPv6 addresses to gather additional information about the target network.
```bash
dnsrevenum6 pri.authdns.ripe.net 2001:67c:2e8::/48 #Will use the dns pri.authdns.ripe.net
```
### DNS Rekurzivni DDoS
Ako je **DNS rekurzija omogućena**, napadač može **falsifikovati** **poreklo** na UDP paketu kako bi naterao **DNS da pošalje odgovor na server žrtve**. Napadač može zloupotrebiti tipove zapisa **ANY** ili **DNSSEC** jer obično imaju veće odgovore.\
Način da **proverite** da li DNS podržava **rekurziju** je da upitujete ime domena i **proverite** da li je **flag "ra"** (_dostupna rekurzija_) u odgovoru:
```bash
dig google.com A @<IP>
```
2024-02-10 13:11:20 +00:00
**Nedostupno**:
![](<../.gitbook/assets/image (275).png>)
2024-02-10 13:11:20 +00:00
**Dostupno**:
![](<../.gitbook/assets/image (276).png>)
<figure><img src="../.gitbook/assets/image (2) (1).png" alt=""><figcaption></figcaption></figure>
**Instantno dostupno podešavanje za procenu ranjivosti i testiranje proboja**. Pokrenite kompletan pentest sa više od 20 alatki i funkcija koje idu od istraživanja do izveštavanja. Ne zamenjujemo pentestere - razvijamo prilagođene alatke, module za otkrivanje i eksploataciju kako bismo im vratili neko vreme da dublje kopaju, otvaraju ljuske i zabavljaju se.
2024-01-11 13:18:30 +00:00
{% embed url="https://pentest-tools.com/" %}
2024-02-10 13:11:20 +00:00
### Slanje e-pošte na nepostojeći nalog
Proučavanjem obaveštenja o nedostavi (NDN) koje je pokrenuto slanjem e-pošte na nevažeću adresu unutar ciljnog domena, često se otkrivaju dragoceni detalji interne mreže.
Dostupni izveštaj o nedostavi uključuje informacije kao što su:
* Generišući server je identifikovan kao `server.example.com`.
* Obaveštenje o neuspehu za `user@example.com` sa kodom greške `#550 5.1.1 RESOLVER.ADR.RecipNotFound; not found` je vraćeno.
* Interni IP adrese i imena hostova su otkriveni u originalnim zaglavljima poruke.
2024-02-06 03:10:38 +00:00
```markdown
The original message headers were modified for anonymity and now present randomized data:
Generating server: server.example.com
user@example.com
#550 5.1.1 RESOLVER.ADR.RecipNotFound; not found ##
Original message headers:
2024-02-06 03:10:38 +00:00
Received: from MAILSERVER01.domain.example.com (192.168.1.1) by
mailserver02.domain.example.com (192.168.2.2) with Microsoft SMTP Server (TLS)
id 14.3.174.1; Mon, 25 May 2015 14:52:22 -0700
Received: from filter.example.com (203.0.113.1) by
MAILSERVER01.domain.example.com (192.168.1.1) with Microsoft SMTP Server (TLS)
id 14.3.174.1; Mon, 25 May 2015 14:51:22 -0700
X-ASG-Debug-ID: 1432576343-0614671716190e0d0001-zOQ9WJ
Received: from gateway.domainhost.com (gateway.domainhost.com [198.51.100.37]) by
filter.example.com with ESMTP id xVNPkwaqGgdyH5Ag for user@example.com; Mon,
25 May 2015 14:52:13 -0700 (PDT)
X-Envelope-From: sender@anotherdomain.org
X-Apparent-Source-IP: 198.51.100.37
```
2024-02-10 13:11:20 +00:00
## Konfiguracioni fajlovi
```
host.conf
2022-10-02 19:15:35 +00:00
/etc/resolv.conf
/etc/bind/named.conf
/etc/bind/named.conf.local
/etc/bind/named.conf.options
/etc/bind/named.conf.log
/etc/bind/*
```
2024-02-10 13:11:20 +00:00
Opasne postavke prilikom konfigurisanja Bind servera:
| **Opcija** | **Opis** |
2022-10-02 19:15:35 +00:00
| ----------------- | ------------------------------------------------------------------------------ |
| `allow-query` | Definiše koje hostove je dozvoljeno slati zahteve DNS serveru. |
| `allow-recursion` | Definiše koje hostove je dozvoljeno slati rekurzivne zahteve DNS serveru. |
| `allow-transfer` | Definiše koje hostove je dozvoljeno primati zone transfere od DNS servera. |
| `zone-statistics` | Sakuplja statističke podatke zona. |
2022-10-02 19:15:35 +00:00
2024-02-10 13:11:20 +00:00
## Reference
2024-02-06 03:10:38 +00:00
* [https://www.myrasecurity.com/en/knowledge-hub/dns/](https://www.myrasecurity.com/en/knowledge-hub/dns/)
2024-02-10 13:11:20 +00:00
* Knjiga: **Network Security Assessment 3rd edition**
2021-08-12 12:57:59 +00:00
2024-02-10 13:11:20 +00:00
## HackTricks Automatske Komande
```
2021-08-12 12:57:59 +00:00
Protocol_Name: DNS #Protocol Abbreviation if there is one.
Port_Number: 53 #Comma separated if there is more than one.
Protocol_Description: Domain Name Service #Protocol Abbreviation Spelled out
2021-08-15 17:42:53 +00:00
Entry_1:
2024-02-10 13:11:20 +00:00
Name: Notes
Description: Notes for DNS
Note: |
#These are the commands I run every time I see an open DNS port
dnsrecon -r 127.0.0.0/24 -n {IP} -d {Domain_Name}
dnsrecon -r 127.0.1.0/24 -n {IP} -d {Domain_Name}
dnsrecon -r {Network}{CIDR} -n {IP} -d {Domain_Name}
dig axfr @{IP}
dig axfr {Domain_Name} @{IP}
nslookup
SERVER {IP}
127.0.0.1
{IP}
Domain_Name
exit
https://book.hacktricks.xyz/pentesting/pentesting-dns
2021-08-15 17:42:53 +00:00
Entry_2:
2024-02-10 13:11:20 +00:00
Name: Banner Grab
Description: Grab DNS Banner
Command: dig version.bind CHAOS TXT @DNS
2021-08-15 17:42:53 +00:00
Entry_3:
2024-02-10 13:11:20 +00:00
Name: Nmap Vuln Scan
Description: Scan for Vulnerabilities with Nmap
Command: nmap -n --script "(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport" {IP}
2021-08-15 17:42:53 +00:00
Entry_4:
2024-02-10 13:11:20 +00:00
Name: Zone Transfer
Description: Three attempts at forcing a zone transfer
Command: dig axfr @{IP} && dix axfr @{IP} {Domain_Name} && fierce --dns-servers {IP} --domain {Domain_Name}
2021-08-15 17:42:53 +00:00
Entry_5:
2024-02-10 13:11:20 +00:00
Name: Active Directory
Description: Eunuerate a DC via DNS
Command: dig -t _gc._{Domain_Name} && dig -t _ldap._{Domain_Name} && dig -t _kerberos._{Domain_Name} && dig -t _kpasswd._{Domain_Name} && nmap --script dns-srv-enum --script-args "dns-srv-enum.domain={Domain_Name}"
Entry_6:
2024-02-10 13:11:20 +00:00
Name: consolesless mfs enumeration
Description: DNS enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/dns/dns_amp; set RHOSTS {IP}; set RPORT 53; run; exit' && msfconsole -q -x 'use auxiliary/gather/enum_dns; set RHOSTS {IP}; set RPORT 53; run; exit'
2021-08-12 12:57:59 +00:00
```
<figure><img src="../.gitbook/assets/image (2) (1).png" alt=""><figcaption></figcaption></figure>
**Trenutno dostupno podešavanje za procenu ranjivosti i testiranje proboja**. Pokrenite kompletan pentest sa više od 20 alatki i funkcija koje idu od izviđanja do izveštavanja. Ne zamenjujemo pentestere - razvijamo prilagođene alatke, module za otkrivanje i eksploataciju kako bismo im vratili nešto vremena da dublje kopaju, otvaraju ljuske i zabavljaju se.
2024-01-11 13:18:30 +00:00
{% embed url="https://pentest-tools.com/" %}
2022-04-28 16:01:33 +00:00
<details>
2024-02-10 13:11:20 +00:00
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
2022-04-28 16:01:33 +00:00
2024-02-10 13:11:20 +00:00
Drugi načini podrške HackTricks-u:
2024-01-03 10:42:55 +00:00
* Ako želite da vidite svoju **kompaniju reklamiranu na HackTricks-u** ili da **preuzmete HackTricks u PDF formatu** Proverite [**PLANOVE ZA PRIJAVU**](https://github.com/sponsors/carlospolop)!
2024-02-10 13:11:20 +00:00
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Otkrijte [**The PEASS Family**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili nas **pratite** na **Twitteru** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Podelite svoje hakovanje trikova slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.
2022-04-28 16:01:33 +00:00
</details>