Let's see what information you can extract from DNS servers.
It will be widely available information.
If someone fails to secure the information they upload to the DNS server it will be easy to get this
information.
We start with a web knowledge base which is most of the Linux distributions have this tool pre-installed.
There's also many graphical versions of the tool and various operating systems.
Let's make a query about for example the Google dot com domain
because in the Internet everyone should cooperate.
The WHO IS database holds domain registration information.
So you can learn among other things what are the servers addresses and the DNS servers IP address is
responsible for the domain you asked about.
You can also find out when the change is concerning the registration of the domain have been made.
You can also see names of the servers responsible for the domain take notice of them if you want to
learn more about the domain.
You can also get to know who's registered the domain and how to contact its owner.
There's a lot of information available to the public.
By completing the domain registration form you can provide information that will compromise security
for example providing the email address in the format name surname at company name you're giving out
information that should not be publicly available on the Internet.
That would give attackers your log in and the corporate network registering a domain.
Remember that the information you put on the form will be publicly available.
Let's now check how much information can be read from the DNS servers.
A standard tool for the communication with DNS server is an ass look Look-Up.
It allows you to send queries to the DNS servers about the names and addresses of DNS servers that are
responding to you.
Backtrack has a few additional tools and scripts that allow you to make various more queries.
One such tool is Digg.
It will allow you to read the information about the records of the DNS server responsible for the domain.
Google.com for example.
With the commands shown you can access the information about all records
in accordance with best practices the public DNS server does not store information about computers of
the corporate network.
If it did everyone could read them with this command.
We've inquired about the default server.
Let's try not to inquire about the.
And that's one dot Google dot com server
in this case we've received similar addresses of the same computers.
Let's try again to execute the command.
It shouldn't work in the case of a well-secured server.
Then we'll see how another server responds to it.
The command above is the zone transfer request.
Remember that DNS servers have a hierarchical structure.
It may happen that one DNS server will ask another server to send the entire database of computers.
We've conducted such an operation using X for the zone transfers should be permitted only for trusted
DNS servers.
Anonymous Internet users should not be able to request the entire database of computers.
As you can see the zones transfer failed.
We will use Digg once more this time asking another domain about server names.
In the answer section there is one of the servers responsible for the domain We've inquired about
Uji DNS that Eugen that be.
We can now ask the selected server about everything it knows about a given domain.
We haven't learned much more
let's try to request a zone transfer.
This time it worked for the next hour or so individual IP addresses and computers names will be displayed
on the screen.
Very often computer names reveal some information about their configuration and the purposes they're
used for.
The name Eskew all server dumb company dot com fully reveals the computer's function in the corporate
network.