Another script in them backtracks which is DNS rekon this is a script written in Perl that allows among
other things to ask for a zone transfer.
However if the transfer is not successful the script will certainly send further queries about individual
computers with a brute force attack.
This script will check all the possibilities.
If a server does not want to send you the entire zone then you ask him for the data concerning individual
computers one by one
will now run the script and ask about the same domain as before.
Agent that be
refund the information about the DNS servers in the servers that are the Kerberos key distribution center.
Now let's see how you can learn something about a specific computer.
For example we would like to find the skewl servers or mail servers of specific companies.
We could search for mail servers by Amex addresses but it won't work with skewl servers.
Now we'd like to ask the DNS server if in the zone it manages there are any computers containing certain
characters in their names.
If we obtain this information we could use it later to identify the infrastructure of a specific company
only need to ask such a query is encoded in the fierce script this script will help us to obtain information
about the DNS servers of our test domain ujian that be.
Then we should specify a dictionary containing expressions will be looking for.
Let's use the standard dictionary that is host that TXI the file this dictionary contains many expressions
and that's why the result is similar to the one we've had earlier.
You can prepare your own TXI script with only those expressions that are especially interesting for
you.
This would allow you to ask the DNS servers about computers whose names could be telling in some ways
this information is publicly available.
To search for it.
You do not need to use Digg or any scripts you can use various web services for this.
One of them is a service available at HTP colon forward slash forward slash server sniff dot net.
It has visualization options.
It will enable you to see that the main DNS server has a particular name and sub servers responsible
for their own domains.
The report will feature as much information as can be collected for an exercise.
You can connect with the service and send a query about your favorite domain.
The first threat associated with application layer protocols is that the attacker can gain information
you'd like to remain private further problems relate to subsequent protocols of this layer.