OK, now to demonstrate what we learned in that theory lecture.
Now we would use the host command to find the IP address of example dot com.
OK, or let's try that on Google dot com.
No problem.
So just like that, if you click it or press, you can see the usage is like this.
It has a lot of features.
And don't worry, we will have a good understanding of this tool because it is very important.
Now, Horst, then the name of the domain.
So Horst, Google Dotcom, OK?
Or sometimes not Google.
The Google Dotcom.
OK.
By the way, you can see that we have different results.
WW instead of Google Dotcom, right?
OK, now let's have a look.
So you can see that Google Dotcom has this address.
And here it has some stuff, demands or whatever.
Also, we have here, and this is a different IP address, by the way.
OK.
And have IP V6, OK?
OK, for now, no problem.
So far, so good.
Now if I want to have hosted for Facebook Dotcom, for example, it has different values as well.
Now let's try this on Google Dotcom, but this time we will use the dashti option or flag and the type
of the record we want to check, for example, the mixed record.
So you can see that these are used for the Amex, by the way.
The main exchange now, let's have another thing, which is text T60, and here you can see we are seeing
some values.
OK, so like the main verification domain, whatever.
We verification and some values.
Now here we are using the type that dashti, which is the type of the DNS records.
OK, so just a minute.
And here you can see that right forward slash next to search.
Yeah, you can see.
Here it is DST, which is the type.
If you scroll down, you can see that we have different values like these.
This option specify the quarry type.
As you can see, see them.
And as I saw a text, the key it's it's right.
It now a good use.
For what we learned from the best script situation is that we want to make a brute force look up mechanism,
OK?
It's clear the screen now actually it is a sin.
So let's go to the desktop now.
Let's open or make a list to the text.
OK, now I can see that we have first shared values DNS.
Let's see.
Drive em, Gmail, whatever and images, etc., etc..
OK, this is just arbitrary list.
We want to use it for a search and search for sub domains inside it.
Now here, let's use for command or for statement.
So for.
But step in and open the door, not saying with brackets to execute a command, which is just the text.
Then what the semi-colon do, and we want to host the dollar sign something that Google Dotcom.
The semicolon then done, OK, by the way, here you can.
You need to put.
Space or here and enter.
You can see that for who will come.
We didn't find first Google that compared to videos, whatever DFS, but drive we found it as you can
see and hear, it's very quiet for it.
Gmail is alias for this value or whatever.
As you can see, Images is an alias for this and has IP addresses.
So by this, we found out we can make a brute force, OK, which is something very good.
OK, now another practice for what we learned using the command.
Now let's put toast.
We'll get it going again.
It would show us these values.
All right.
You know, we're designing societies.
I want to have just these values, as you can see for one, two three.
OK.
And I want them to be resolved to be sorted as well.
How should I do that?
We will use the Bible in that case.
So here we don't need to have everything here.
We just want the last.
These.
OK.
So let's help tell.
And one, two, three, four, five five.
Or minus five, they mean you can see that, yeah, we have him here.
OK, this is the first step.
Then the output will be cut.
That's David Delimiter.
And it will be space.
As you can see between each one is the space.
And until we reach that one, we want.
So one two three four five six.
So we want to f that field would be six.
OK, like this?
As you can see, yeah, I made them stick is seven, actually not six, because here it is.
This is the number.
All right.
Seven.
No problem.
Yeah, we have it here.
So we got the domains, the sub domains and the noise zone for Google dot com.
OK.
By the way, we can make a best script for this.
Still, we can get.
Fancy resort.
All right.
Something for automation and all of that stuff.
Now we have other tools in clinics.
Which is the inner city corn.
So the corn like that and as you can see here it is now, the usage is like that.
That's the domain, which is Google dot com.
And what tenacity or type and what the you want a SFR, for example.
And the presenter.
Now you can see that this will show us other options.
Or other resorts?
I mean, it seems that there is a problem here in this tool.
Let's let's remove that dashti option.
Yeah, you can see that we are seeing a different or more values than the host utility.
So as you can see for you as an ethical hacker or hacker, you need a team member.
You need to get used to everything, OK, you need to write your own tools and use all the tools or
that ease of tools, not just using one tool, because some result may be different.
And after all, we are attacking the system.
So use whatever tools you want and actually not to one tool.
Make sure you have many tools or you are learning or you have learnt many tools to use.
OK, so that's why.
So, as you can see, the DNS record is showing us more information than just as you can see.
OK, cool.
Again, we can use best script or automation to have a termination for subdomains or whatever, or IBS
and etc., etc..
Now there is another tool called DNS Enum, so a DNS enum like that.
And here you can see it would show us values.
So let's try it out for Google Dotcom.
OK.
And you can see the US is showing more verbose ism stein as you can see the host the name servers.
Here it is, the host addresses.
Here it is then.
Or email exchange server.
Here it is.
And it will start trying on transfer or whatever.
As you and as you can see, it is guessing as well as you can see brute forcing and using this and at
the as the text file.
This is something already exist in Kali Linux.
All right.
Now let's with a little bit just to find what we will see.
By the way, you can see it will start showing us a lot of subdomains because we are forcing.
So I want to press concurrency.
So to stop it?
OK?
And here you can see we have a lot of directories or a lot of subdomains that's showing up.