# DNS DNS is mostly `UDP/53`, but DNS will rely on `TCP/53` more heavily as time progresses. DNS has always been designed to use both UDP and TCP port 53 from the start, with UDP being the default, and falls back to using TCP when it cannot communicate on UDP, typically when the packet size is too large to push through in a single UDP packet. Also treated in [DNS](/footprinting/dns.md) ## Enumeration ```bash nmap -p53 -Pn -sV -sC ``` ## DNS Zone Transfer ```bash dig AXFR @ns1.inlanefreight.htb inlanefreight.htb ``` Tools like [Fierce](https://github.com/mschwager/fierce) can also be used to enumerate all DNS servers of the root domain and scan for a DNS zone transfer: ```bash fierce --domain zonetransfer.me ``` ## Domain Takeovers & Subdomain Enumeration **Subdomain Enumeration** ```bash ./subfinder -d inlanefreight.com -v ``` An excellent alternative is a tool called [Subbrute](https://github.com/TheRook/subbrute). This tool allows us to use self-defined resolvers and perform pure DNS brute-forcing attacks during internal penetration tests on hosts that do not have Internet access. ```bash git clone https://github.com/TheRook/subbrute.git >> /dev/null 2>&1 cd subbrute echo "ns1.inlanefreight.com" > ./resolvers.txt ``` ```bash ./subbrute.py inlanefreight.com -s ./names.txt -r ./resolvers.txt ``` The tool has found four subdomains associated with `inlanefreight.com`. Using the `nslookup` or `host` command, we can enumerate the `CNAME` records for those subdomains. 
host support.inlanefreight.com

# support.inlanefreight.com is an alias for inlanefreight.s3.amazonaws.com
The `support` subdomain has an alias record pointing to an AWS S3 bucket. However, the URL `https://support.inlanefreight.com` shows a `NoSuchBucket` error indicating that the subdomain is potentially vulnerable to a **subdomain takeover**. Now, we can take over the subdomain by creating an AWS S3 bucket with the same subdomain name.
The [can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) repository is also an excellent reference for a subdomain takeover vulnerability. ## DNS Spoofing Example attack paths for the DNS Cache Poisoning are as follows: * An attacker could intercept the communication between a user and a DNS server to route the user to a fraudulent destination instead of a legitimate one by performing a Man-in-the-Middle (`MITM`) attack. * Exploiting a vulnerability found in a DNS server could yield control over the server by an attacker to modify the DNS records. ### **Local DNS Cache Poisoning** From a local network perspective, an attacker can also perform DNS Cache Poisoning using MITM tools like [Ettercap](https://www.ettercap-project.org/) or [Bettercap](https://www.bettercap.org/). To exploit the DNS cache poisoning via `Ettercap`, we should first edit the `/etc/ettercap/etter.dns` file to map the target domain name (e.g., `inlanefreight.com`) that they want to spoof and the attacker's IP address (e.g., `192.168.225.110`) that they want to redirect a user to: ```shell-session cat /etc/ettercap/etter.dns inlanefreight.com A 192.168.225.110 *.inlanefreight.com A 192.168.225.110 ``` Next, start the `Ettercap` tool and scan for live hosts within the network by navigating to `Hosts > Scan for Hosts`. Once completed, add the target IP address (e.g., `192.168.152.129`) to Target1 and add a default gateway IP (e.g., `192.168.152.2`) to Target2. Activate `dns_spoof` attack by navigating to `Plugins > Manage Plugins`. This sends the target machine with fake DNS responses that will resolve `inlanefreight.com` to IP address `192.168.225.110` After a successful DNS spoof attack, if a victim user coming from the target machine `192.168.152.129` visits the `inlanefreight.com` domain on a web browser, they will be redirected to a `Fake page` that is hosted on IP address `192.168.225.110`: --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.rtlcopymemory.com/attacking-common-services/dns.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.