Tool introduction: dig
The domain name can provide important information about the job of a target system: As humans have a hard time remembering a random sequence of numbers, IT systems are usually assigned a meaningful designation. As attackers we can take advantage of this fact by attempting to narrow down the target network or a domain via DNS queries. Here, we can perform both forward lookups and reverse lookups.
When we use a forward lookup, we attempt to resolve a domain name into its associated IP address via the responsible DNS server. This occurs, for example, when opening a website using its name. Furthermore, we may attempt to identify additional IT systems in a network by probing various subdomains. For example, a company like Dubius Payment Ltd. may designate a firewall through the subdomain fw. This means we need to carry out a forward lookup for the full domain name fw.dubius-payment.com. These types of DNS queries can be accomplished with the dig tool (domain information groper):
- dig ${domain name} @${DNS server} +short
Unlike a forward lookup, with a reserve lookup we have the IP addresses of the target systems available to us and we “only“ aim to determine the domain name. As mentioned previously, the domain name reveals information about the function of a system. The domain name db.dubius-payment.com, for instance, is likely to hold a database on the existing system. So we should query the possible domain name for each IP address in a network:
-dig -x ${IP address} @${DNS server} +short
Sometimes we get lucky as attackers. With DNS, this would be a permitted zone transfer. With a successful zone transfer, we end up with a list of resource records and are thus endowed with the relevant information on a domain:
-dig axfr ${Domain} @${DNS server}
But as much as we would like to have the zone file of a domain available to us, this is rarely the case. It may even be the case that no DNS entries are stored for an IT system, so that we should be grateful for any additional information available.
Pentest Training
Take a look at the pentest training chapters and learn penetration testing:
- Preface
- Introduction
- Legal Framework
- Hacking vs. Penetration Testing
- Classification
- Meaningfulness of Penetration Tests
- Penetration Testing Standards
- The Hacking Guide
- Hacking I: Scanning networks
- Hacking II: Password attacks
- Hacking III: Web application attacks
- Hacking IV: Privilege Escalation
- Hacking V: Tunnelling Techniques
- Hacking VI: Vulnerability scanner and penetration testing frameworks
- Demonstration of a Penetration Test
- Risk Assessment of Identified Vulnerabilities
- Structure of Documentation and Reporting
- Insider stories: Tales from Dubius Payment Ltd.
binsec academy GmbH – Advanced Pentest Training Lab
binsec academy GmbH operates the Pentest Training Lab, a highly practical online platform dedicated to real penetration testing. Simulating complex corporate networks and advanced real-world attack scenarios within isolated lab environments, it is engineered to sharpen the skills of aspiring and professional penetration testers. Upon conquering our rigorous, fully practical examination, participants earn the distinguished Binsec Academy Certified Pentest Professional (BACPP) designation — proving their technical capability to methodically uncover and evaluate vulnerabilities in modern IT infrastructures.
Explore the Pentest Training Lab
binsec GmbH – Experts in Penetration Testing
As the operative pentesting core of the binsec group, binsec GmbH has provided high-end, human-led penetration testing since 2013. Rejecting automated scans, our permanently employed, certified senior pentest experts deliver manual deep-dive assessments of web applications, APIs, mobile apps, complex network infrastructures, cloud environments, and advanced red team simulations. Specializing in high-regulation sectors like Payment, Banking, and Healthcare, we provide clear risk evaluations and actionable reports to effectively assess your business-critical systems.
Get Manual Expert Penetration Testing Services