{"id":1091,"date":"2024-11-02T09:34:08","date_gmt":"2024-11-02T09:34:08","guid":{"rendered":"https:\/\/hackmybox.com\/?p=1091"},"modified":"2025-09-08T16:31:27","modified_gmt":"2025-09-08T16:31:27","slug":"footprinting-dns","status":"publish","type":"post","link":"https:\/\/hackmybox.com\/index.php\/2024\/11\/02\/footprinting-dns\/","title":{"rendered":"Footprinting -DNS"},"content":{"rendered":"

(Insights from HTB Academy)<\/span><\/strong><\/h3><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

DNS Functionality:<\/span> Key thing is to understand how DNS works . DNS translates computer names into IP addresses. It converts human-readable domain names into machine-readable IP addresses, which is crucial for the functioning of the internet. For example, your web browser queries DNS to load internet resources effectively.<\/p>

Linux vs. Microsoft DNS<\/span>: It's been a while since I configured DNS on Linux, as I usually deploy DNS using Microsoft Server. While both serve the same primary function\u2014resolving names to IP addresses\u2014their configurations and management interfaces differ significantly. Microsoft DNS is often managed through the GUI of Windows Server, whereas Linux DNS configurations are typically handled through configuration files like named.conf<\/code> for BIND. I need some time to explore and test these tools with Microsoft DNS servers.<\/p>

Tools:<\/span><\/p>

  • Dig: Good for querying DNS records and performing lookups.<\/li>
  • Dig-AXFR: Correctly identified as a method for zone transfers, allowing you to retrieve the complete zone file from a DNS server.<\/li>
  • Nslookup: A classic tool for querying DNS<\/li>
  • Dnsenum: Used for DNS enumeration, which is critical for gathering information about a domain.<\/li><\/ul><\/div><\/div>

    Task:<\/span><\/p>

    In the module, we are tasked with querying the target DNS using its IP address and enumerating details for the 'inlanefreight.htb' domain.<\/p><\/div><\/div>

    Using the dig<\/span> tool, we can find the required details. The key is to keep querying all subdomains.<\/p><\/div><\/div>

    \"\"<\/div><\/div>