Zone transfer With Dig || Ethical Hacking Course
Hello everybody and welcome back.
And this is the last part of the footprinting section where we will cover two tools which are basically
almost the same, but there are slight differences between them.
The first one is called dig.
So if we just type here on your keyboard dig, you will notice that nothing will happen since we didn't specify
any website.
But for more information we will just type here
dig --help to provide us with the simple usage of this command.
Now you can use any website for this.
It is basically not illegal.
This is just a tool not to scan the DNS. Dig basically stands for domain information groper, and with it
you can basically try one of the attacks which is called the zone transfer. Now the zone transfer
basically it uses the replication for primary and secondary DNS servers in order to be synchronized.
Basically, the secondary server, for example, asks for data for zone from primary server, and the primary server
answers with a copy of the database which has IP addresses and name of hosts.
Now from configuration of the DNS can potentially allow anyone to request a zone transfer.
So, with this tool we will try out the zone transfer on some of the bigger web sites, which of course
won't work.
But on the smaller ones, there could possibly be a mis configuration in the DNS so that the zone transfer
is enabled. Now zone transfer is happening on TCP on Port 53, and not over UDP at the regular port of 53
for the DNS.
So if you just type here dig google.com, you will notice that it would give us a bunch of the information
about google.com.
So, for example, as we can see this is the DNS query right here.
The NS right here stands for name server, and you can see that there are four of them. The A basically
represents the IP address. The one A stands for the IPV4 IP address, and four AAAA stands for the IPV6
IP address. We can see also some of the other options which is the server that it used to query, which is
our own router on port 53. As you can see, the usual DNS port will be port 53 over UDP. And
my router IP address
192.168.1.1
We can see that the one query we got one answer. Authority for which is these four servers right here.
An additional 9, I believe, is referring to this one right here, even though there is 8. But
these are basically the same servers just with a different IP address. Not different IP address, different
format of IP address.
This one is, as I said, IPV4 and this one right here is IPV6 IP address. So that is the basic use
of the dig command.
You can use it to find out some of the information about the domain.
But if you, for example, want to try out the zone transfer, you can do it like this, for example.
So just type here dig, and then you type here axfr which stands for the zone transfer.
Now we can use, for example, facebook.com, and we can use the other server, for example,
(A.NS.FACEBOOK.COM)
And if we try to run this right here after a few seconds it will basically prompt us
with zone transfer failed
since Facebook didn't mis-configure the DNS. So the zone transfer tech cannot be done on Facebook.
Now there may be other smaller sites that could be possibly vulnerable to the zone transfer attack, but
we won't be trying to find them at the moment.
This is just one of the tools that you can use in order to find out if it is vulnerable.
But let me just show you another tool right here which is called dnsenum, which is also pre-installed
on Kali Linux.
So basically it is the same as the dig tool. If we type right here dnsenum google.com,
it will provide us with similar information. As we can see, host's addresses google.com, which the A stands
for the IPV4, and then it will print us the IP address, the IPV4 address of google.com.
And right here it is trying to find out some of the name servers of Google. As we saw before,
there should be four of them.
#EthicalHackingcourse #ethicalhackingcourse #Coding Master