Enumerating DNS using DNSRecon
In the following sections, we will explore a couple of tools that allow us to conduct DNS reconnaissance. In effect, this means identifying our target organization's DNS servers and subsequently the DNS entries contained in them.
Getting ready
DNSRecon comes preinstalled on Kali Linux. If you are using a different Linux/Unix distribution, it can be downloaded and installed from https://github.com/darkoperator/dnsrecon.
How to do it…
DNSRecon is a Python script written by Carlos Perez for conducting DNS reconnaissance. It can enumerate general DNS records, perform zone transfers, perform reverse lookups, and brute-force subdomains among other functions. It will even perform Google scanning, automating the process we discussed in the Using Google to find subdomains section. To see usage information for dnsrecon
, run the following command from within the /usr/share/dnsrecon
directory:
dnsrecon -h

Standard DNS enumeration
A standard DNS enumeration should provide us with...