Reconnaissance & Scanning

The topics we'll cover.

• Passive Scanning: Its simply like your watching someone's facebook account. you see the details and the posts that he shared but you don't interact with the target or send him any messages or like his posts.

• Active Scanning: The target knows you were there. You may send the target a message to discover specific info or you may accidentally like one of his posts so he know you were there.

Under passive, we'll look at WHOIS, Google Dorking, and Shodan.

Under active, we'll cover host scanning and port scanning.

(Passive Scanning)

At its simplest level, passive scanning means you observe, but you do not interact. You collect information that is already available through legitimate channels, without sending any packets, making any connections, or triggering any logs on the target's infrastructure.

You are simply collect the available information that is already available, either because the target has made it public or because it's leaked inadvertently.

characteristics:

1. Non-Intrusive

The scanner does not send any requests, or packets that could affect the target. No scanning tools touch the target's systems. No network traffic is generated toward the target.

2. Observational

The scanner gathers information from sources that already exist. It does not create new data; it consumes existing data.

The scanner is a consumer, not a producer. It reads what is already there.

3. Low Visibility (Undetectable)

The target has no way of knowing they are being observed. Because no active interaction occurs, there is no evidence left behind.

Why This Is True:

• No Logs: Target systems generate logs only when they receive and process traffic. Passive scanning generates no traffic, so no logs.

• No Alerts: Security tools alert on patterns of suspicious traffic. No traffic means no alerts.

• No Footprint: There is no IP address to trace back, no user-agent to identify, no connection to attribute.

The Result:

Passive reconnaissance is completely invisible. The target continues operating normally, unaware that an external party is gathering intelligence about them.

Why is this important for us? As attackers or penetration testers, we start with passive reconnaissance because it's safe. We can gather a massive amount of information with zero risk of detection.

(Passive Information Gathering Techniques)

WHOIS Enumeration

WHOIS is a protocol and a database. When someone registers a domain name (e.g. let's say example.com) they have to provide information to the domain registrar.

This information is stored in a public database called WHOIS.

By querying this database, anyone can find out:

• Who registered the domain (the registrant's name and organization)

• Contact information (email address, phone number, physical address)

• Technical contact details

• The nameservers the domain uses

• When the domain was registered and when it expires

Google Dorking

Also called Google Hacking.

Google Dorking is an advanced searching technique that uses specialized operators and filters in Google Search to uncover information that isn't typically accessible through basic searches.

What are search operators?

You probably use Google by typing simple words. But Google has special commands called 'operators' that let you refine your search with incredible precision. When attackers combine these operators in clever ways, it's called Google Dorking.

Essential Google Dorking Operators

These operators are the building blocks of any good dork. They allow you to narrow down Google's massive index to just the information relevant to your target .

The slide gives an example: site:example.com filetype:pdf

Let's break that down:

• site:example.com tells Google, 'Only show me results from this specific website.'

• filetype:pdf tells Google, 'Only show me PDF files.'

So together, this search finds every PDF file on example.com that Google has indexed.

Example lesson: Applying Google Dorking (safe demo)

Let’s use nasa.gov as a teaching target.

1. site: operator (foundation of recon)

site:nasa.gov

Shows only pages indexed from NASA.

2. filetype: operator

site:nasa.gov filetype:pdf

3. inurl: operator

site:nasa.gov inurl:login

4. intext: keyword discovery

site:nasa.gov intext:"report"

Demonstrating combined operators

Example:

site:nasa.gov filetype:pdf "mission"

We are filtering by domain + file type + keyword simultaneously.

Why this works: Companies often put files on public web servers without realizing search engines will find and index them. Error messages, login pages, configuration files—if it's accessible on the web and not password-protected, Google can find it.

Shodan.io

The third technique: Shodan.io.

Shodan.io is a search engine.

A search engine is a software system designed to carry out web searches. It searches the World Wide Web in a systematic way for particular information specified in a textual web search query.

Example: Google

How general-purpose search engines work:

• Crawling – Web crawlers (bots) browse the internet and follow links to discover publicly available web pages.

• Indexing – Information from crawled pages is stored, parsed, and organized in massive databases so it can be quickly retrieved.

• Ranking – When a user searches for a term, the search engine uses algorithms to sort and return the most relevant results from its index.

If shodan is a search engine, What makes it different from Google?

Google searches websites. Shodan searches devices connected to the internet.

• General‑purpose search engine for indexing and retrieving web pages and public content.

• news, websites, images, maps, shopping, etc.

Shodan

• A specialized search engine for internet‑connected devices (IoT, servers, webcams, routers, etc.).

• Indexes services, open ports, and device banners, not web pages.

What They Search?

Google

• HTML pages, documents, videos, images, and public web content.

• Uses crawlers to follow hyperlinks and index content.

Shodan

• Networked devices and services.

• Scans IP addresses and records things like:
  • Open ports (e.g., 80, 443, 22)

  • Protocols (HTTP, SSH, FTP, Modbus, etc.)

  • Banner info (software versions, headers)

Example Outputs

Google query:

best coffee shops in Tokyo

→ list of webpages, maps, reviews

Shodan query:

port:22 country:US

→ list of devices with SSH open in the U.S.

Shodan constantly scans the entire internet, connecting to every IP address and collecting 'banners.'

A banner is the initial information a service sends when you connect to it. like 'Hello, I'm an Apache web server version 2.4.49' or 'Hello, I'm a default login screen for a security camera.'

(Demonstration with examples): An attacker might search Shodan for:

• port:21 Anonymous login - Finds FTP servers that allow anonymous access.

• port:3389 country:US - Finds RDP (Remote Desktop) servers in the United States.

• title:"default login" - Finds devices with default login pages.

• product:MySQL - Finds MySQL databases exposed to the internet.

Part 2: Active Scanning Fundamentals

(Active Scanning)

We've gathered all the public information we can (IP addresses, hostnames, etc). Now it's time to engage directly with the target. This is Active Scanning.

(Definition): 'Active scanning is a proactive cybersecurity technique involving the intentional probing and examination of systems, networks, or applications to identify vulnerabilities, weaknesses, or security issues.'

Characteristics:

• Proactive Engagement

  You are no longer just observing. You are initiating contact with the target. You send packets, establish connections, and request information. You are actively asking questions:

  • "What ports are open?"

  • "What service is running on port 80?"

  • "What version of Apache is this?"

  • "Does this login form accept SQL injection?"

  • "Will this service crash if I send malformed data?"

  How It Works:

  • The scanner crafts specific packets, requests, or payloads.

  • It sends them to target IP addresses and ports.

  • It listens for and analyzes responses.

  • Based on responses, it draws conclusions about the target.

  Examples of Proactive Engagement:

  • Sending an ICMP echo request (ping) to see if a host is alive.

  • Connecting to port 80 and sending an HTTP GET request to see what web server responds.

  • Sending specially crafted packets to fingerprint an operating system.

  • Attempting to log in with default credentials.

  Proactive engagement is the only way to discover certain information:

  • You cannot know if a firewall rule allows port 22 unless you try to connect to it.

  • You cannot know if a web application is vulnerable to SQL injection unless you send malicious payloads.

  • You cannot know if a service is outdated unless you query its version banner.

• Penetration Testing

  Active scanning is the core activity of penetration testing. When an ethical hacker is authorized to assess a system, they actively probe it to find weaknesses before real attackers do.

  The Ethical Framework:

  • Authorization: Active scanning is only performed with explicit permission. Unauthorized active scanning is illegal and considered reconnaissance for an attack.

  • Rules of Engagement: Scope, timing, and techniques are defined before scanning begins. The tester knows what is allowed and what is off-limits.

  • Safety Measures: Active scanning can potentially disrupt services. Testers take precautions (rate limiting, avoiding dangerous payloads) to minimize risk.

Common Tools:  Nmap, Nessus, and OpenVAS.

(Active Information Gathering Techniques)

There are two main categories of active scanning: Host Scanning and Port Scanning.

But before exploring the host and port scanning, what is the host and what is the port?

Host

A host is any device connected to a network that has an IP address and can send or receive data.

Examples of hosts:

• A laptop or desktop computer

• A web server

• A router

• A mobile device

• A cloud VM (e.g., an instance on Amazon Web Services)

In simple terms:

If it has an IP address and communicates on a network, it’s a host.

When we talk about host scanning, we are asking:

“Which IP addresses are alive?”

Port

While the IP address identifies the device, the port identifies the specific service running on that device.

When we talk about port scanning, we are asking:

“Which services are open on this live host?”

Host Scanning

Host Scanning answers a simple question: 'Which systems on this network are actually alive and responding?'

Think about a typical company network. It might have thousands of IP addresses. But not every IP address corresponds to an active computer. Some might be unused. Some might be printers. Some might be servers. Before an attacker can dig deeper, they need a map of live targets.

(How do you know if a host is alive?)

You ask it. You send a packet and see if it replies.

The slide lists three techniques:

• ICMP Echo (Ping): 

  Ping (ICMP)

  This is the most basic. You send an ICMP Echo Request packet. If the host is alive and not blocking ICMP, it sends back an Echo Reply. Simple. But many organizations block ICMP at their firewalls, so a lack of reply doesn't always mean the host is dead.

• TCP ACK/SYN Ping: 

  TCP

  Even if ICMP is blocked, many hosts will still respond to TCP probes. You send a TCP packet with the ACK flag set, or the SYN flag set, to a common port (like port 80 for web, or port 443 for HTTPS). If the host is alive, it will often respond with a RST (reset) packet, even if the port is closed. That response tells you the host exists.

• ARP Scanning: 

  ARP

  This one only works on your local subnet—the network segment you're directly connected to. ARP (Address Resolution Protocol) is how your computer asks, 'Who has this IP address?' Every device on the local subnet must respond to ARP requests. So ARP scanning is the fastest and most reliable way to find live hosts on your own local network. It's like shouting in a room—everyone has to answer.

Port Scanning

Once you know a host is alive, the next question is: 'What services is it running?' That's Port Scanning.

There are 65,535 possible TCP ports and 65,535 possible UDP ports.

A port scanner tries connecting to each port to see which ones are 'open', meaning a service is listening there.

The slide mentions three scanning techniques:

• TCP Connect Scan: This completes the full TCP three-way handshake.
  • The scanner sends a SYN packet.

  • If the port is open, the target replies with SYN-ACK.

  • The scanner responds with ACK, completing the full TCP three-way handshake.

  • Then the connection is closed.

  Key characteristics:

  • Completes the entire TCP connection

  • More detectable (noisy)

  • Slightly slower

  Example handshake:

  Scanner → SYN → Target
  Target  → SYN-ACK → Scanner
  Scanner → ACK → Target   (connection established)

• SYN Scan (Half-Open): This is stealthier.
  • Scanner sends SYN

  • If the port is open, target replies SYN-ACK

  • Instead of completing the handshake, the scanner sends RST to terminate the connection.

  So the connection is never fully established.

  Example:

  Scanner → SYN → Target
  Target  → SYN-ACK → Scanner
  Scanner → RST → Target

  Key characteristics:

  • Does NOT complete the handshake

  • Faster

  • More stealthy

• UDP Scan: TCP is reliable, connection-oriented. UDP is connectionless. Think DNS queries, streaming video, VoIP. Scanning UDP is harder because open ports don't always respond, and closed ports may just drop the packet. Often, you have to send protocol-specific probes to get a response.

(Nmap demonstration): The most famous port scanner is Nmap. A basic command like nmap -sS 192.168.1.100 performs a SYN scan on the most common 1000 ports.

Within seconds, you get a list:

'22/tcp open ssh

80/tcp open http

443/tcp open https.'

Part 3: Enumeration and Fingerprinting

(Enumeration and Fingerprinting)

Before enumeration and fingerprinting, you know basic facts:

• "There is a host at 10.10.1.45."

• "Port 80 is open."

• "Port 22 is open."

After enumeration and fingerprinting, you know:

• "The host at 10.10.1.45 is a web server running Apache 2.4.41 on Ubuntu 20.04."

• "Port 22 is OpenSSH 7.9p1."

• "The server has user accounts: john, admin, backup."

• "There's a network share called 'docs' accessible to guests."

• "Apache is vulnerable to CVE-2021-41773."

This is the difference between a map and a detailed reconnaissance report. The map tells you where things are. The report tells you exactly what those things are, how they're configured, and how to exploit them.

Enumeration

Enumeration is the active process of extracting detailed information about network resources, users, shares, services, and configurations. It often involves authenticated or unauthenticated queries to systems to gather data such as user accounts, group memberships, and shared folders.

Key Characteristics:

• Extractive: Pulls information directly from systems.

• Often Interactive: May involve making multiple requests, listing directories, querying APIs.

• Resource-Specific: Different techniques for different services (SMB enumeration, SNMP enumeration, DNS enumeration, etc.).

• Can Be Authenticated or Unauthenticated: Some information is available to anyone; some requires valid credentials.

What Enumeration Reveals:

Fingerprinting

Fingerprinting is about identifying specific characteristics of systems such as the operating system, running services, and software versions typically to assess potential vulnerabilities. It can be active (sending crafted packets and analyzing responses) or passive (monitoring network traffic).

Key Characteristics:

• Identification-Focused: Determines exact software and versions.

• Technique-Varied: Uses different methods for different protocols.

• Basis for Vulnerability Mapping: Once you know versions, you can look up known vulnerabilities.

• Can Be Active or Passive: Active fingerprinting sends probes; passive fingerprinting analyzes existing traffic.

What Fingerprinting Reveals:

Enumeration vs. Fingerprinting

They Work Together:

• Fingerprinting tells you: "This is a Windows Server 2019 running IIS 10.0."

• Enumeration then tells you: "It has users: Administrator, John, Backup; shares: C$, ADMIN$, Docs; and the guest account is enabled."

(Services to Enumerate)

This slide lists the specific services we're going to dive into. These are the most common services you'll encounter in penetration testing and real-world attacks:

• SMB (Server Message Block): File sharing in Windows networks

• FTP (File Transfer Protocol): Old but common file transfer

• NFS (Network File System): File sharing in Unix/Linux networks

• RDP (Remote Desktop Protocol): Windows remote GUI access

• SSH (Secure Shell): Secure remote command-line access

• DNS (Domain Name System): The phonebook of the internet

Each of these services leaks information. Each can be misconfigured. Each can be a pathway into a network.

(Server Message Block - SMB)

SMB (Server Message Block) is the primary protocol used by Windows systems for file sharing, printer sharing, and inter-process communication over a network.

How SMB Works

SMB operates in a client-server model:

• The Client: A computer, laptop, or any device that wants to access a shared resource. It runs an SMB client (built into Windows, macOS, and Linux).

• The Server: A device that hosts the shared files or printers. It runs SMB server software.

The Basic Process:

• The client sends an SMB request to the server to connect.

• The client and server establish a connection, often requiring authentication (username and password).

• Once connected, the client can send further SMB commands to the server.

Why attackers love SMB:

• Version exploits: Older versions, especially SMB1, have catastrophic vulnerabilities.

  EternalBlue was an SMBv1 vulnerability that powered the WannaCry ransomware outbreak in 2017. It allowed attackers to take over entire systems without any credentials.

• Null/guest sessions

  What Is a Null Session?

  A null session is an SMB connection established without a username or password. The client essentially says, "I'm nobody," and the server responds with whatever information it's configured to share anonymously.

  Guest Sessions:

  The Guest account is a built-in Windows account with no password. If enabled, anyone can authenticate as Guest and gain access to resources the Guest account can access. Often, this includes the ability to enumerate significant information.

  What Attackers Get from Null/Guest Sessions:

  Information	How It Helps Attackers
  User Lists	Valid usernames for password attacks or phishing
  Share Lists	Targets for data theft; potential entry points
  Domain Information	Understanding network structure for lateral movement
  Password Policies	Fine-tune brute-force attacks to avoid lockouts
  SID Mapping	Translate between usernames and security identifiers

• Weak credentials: Even when authentication is required, SMB shares are often protected by weak passwords.

  Common Problems:

  • Default credentials unchanged (admin/admin, administrator/password).

  • Simple passwords (password, 123456, company name).

  • Shared passwords across multiple shares.

  • Service accounts with weak or non-expiring passwords.

  • Password reuse with other systems.

Key commands and tools:

1. List shares with smbclient (Null Session)

smbclient --no-pass -L //<IP>

Breaking it down:

• smbclient: A command-line tool like an FTP client for SMB shares

• -no-pass: Tells it to try connecting without providing any password

• L: "List" mode - shows available shares

• //<IP>: The target computer's network address

Why this works:

This tries a "null session" - connecting with no credentials. On poorly configured Windows systems (especially older ones), this is allowed and reveals all shared folders. It's like walking up to a building and the receptionist giving you a complete directory without asking who you are.

Example output:

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
Documents       Disk
Printers        Disk

2. List shares with CrackMapExec

crackmapexec smb <IP> -u user -p pass --shares

Breaking it down:

• crackmapexec: post-exploitation and network assessment tool

• smb: Tells it to use SMB protocol

• <IP>: Target address

• u user: Username to authenticate with

• p pass: Password for that user

• -shares: Command to enumerate shared folders

Why this is different:

Unlike the null session approach, this uses actual credentials. CrackMapExec is more sophisticated and can also check for vulnerabilities, password policies, and other system information.

What makes it powerful:

• Tests credentials across multiple systems

• Checks if passwords are valid

• Shows which shares are readable/writable

• Can be used in penetration testing to map out network shares

3. Access a share with smbclient

smbclient //<IP>/<share>

Breaking it down:

• smbclient: The first tool we used before

• //<IP>/<share>: The full path to a specific share (like //192.168.1.10/Documents)

What happens next:

It may ask you to enter the username and password / It also may not

Once connected, you get an FTP-like interface with commands:

• ls - List files

• cd folder - Change directory

• get file.txt - Download a file

• put file.txt - Upload a file

• help - Show all commands

Example session:

smb: \> ls
  .                                  D        0  Mon Jan 15 10:30:00 2024
  ..                                 D        0  Mon Jan 15 10:30:00 2024
  reports                            D        0  Mon Jan 15 09:15:00 2024
  invoice.pdf                        A    24576  Mon Jan 15 08:45:00 2024

smb: \> get invoice.pdf
getting file \invoice.pdf of size 24576 as invoice.pdf (125.8 kb/s)

4. Mount a share

What is "Mounting" in Simple Terms?

Think of mounting like plugging in a USB drive:

• When you plug in a USB drive, it "appears" as a new folder on your computer (like /media/usb or D:\ on Windows)

• You can then open files from that USB drive using normal programs like they're on your own computer

• When you're done, you "eject" it safely

Mounting a network share is exactly the same concept, but instead of a physical USB drive, the files are coming from another computer over the network.

mount -t cifs //<IP>/<share> /mnt/share

Breaking it down:

• mount: Linux command to attach filesystems

• t cifs: Specifies the filesystem type as CIFS (Common Internet File System) - the modern version of SMB

  When you specify -t cifs, you're telling Linux: "Use the CIFS driver to handle all interactions with this remote folder." This driver acts like a translator between your Linux system and the Windows/SMB server.

• //<IP>/<share>: The remote share location

• /mnt/share: Local directory where you want to access the files

Why mounting is useful:

Instead of using a special client with limited commands, mounting integrates the remote share into your normal filesystem. You can then:

• Browse with any file manager

• Open files in your regular applications

• Copy files with drag-and-drop

• Use normal Linux commands like cp, mv, ls

Before mounting:

# You have to use special commands:
smbclient //192.168.1.100/Reports
smb: \> ls
smb: \> cd finance
smb: \> get quarterly-report.pdf
# Then you have to exit and open the file locally

After mounting:

# After mounting, the remote files just look like local files:
cd /mnt/company-reports
ls                    # Works like normal!
cd finance            # Just like a local folder
cp quarterly-report.pdf ~/Documents/  # Copy like any file
firefox /mnt/company-reports/index.html  # Open directly in browser

(File Transfer Protocol - FTP)

FTP, File Transfer Protocol, is one of the oldest protocols on the internet. It's designed for transferring files between a client and a server.

Key weaknesses:

• Authentication sent in cleartext: Your username and password travel across the network unencrypted. Anyone sniffing traffic can steal them.

• Anonymous access: Many FTP servers are configured to allow 'anonymous' login—anyone can connect with username 'anonymous' and any password (or 'anonymous' as the password).

• Data also in cleartext: The files you transfer are also unencrypted.

Key commands:

• Connect:

  ftp <IP>

  This opens an FTP session. You'll be prompted for username and password.

• Anonymous login:

  Username: anonymous

  Password: anonymous 

  This is the standard way to test for anonymous FTP access.

• Download a file:

  get <filename>

  Once connected, this downloads a file from the server.

• Upload a file:

  put <filename>

  If you have write permissions, this uploads a file to the server. Attackers love this—they might upload a web shell or malicious script.

• Brute-force with Hydra:

  hydra -L users.txt -P passwords.txt <IP> ftp

  Hydra is a fast login cracker. This command tries every combination of usernames from users.txt and passwords from passwords.txt against the FTP service.

(Remote Desktop Protocol - RDP)

RDP, Remote Desktop Protocol, is Microsoft's protocol for remote GUI access. It's what you use when you connect to another Windows computer and see its desktop on your screen. System administrators love it because they can manage servers from anywhere.

Attack surface:

Mainly authentication weaknesses and misconfigurations: Because RDP’s network exposure is limited, most attacks target how it’s configured or accessed, not some obscure protocol flaw.

Common issues include:

• Weak passwords or default credentials.

• Allowing RDP access from the internet directly.

• Not using account lockouts or multi-factor authentication.

• Misconfigured permissions that allow unprivileged users to gain higher access.

Key tools and commands:

• Remmina: A modern, feature-rich remote desktop client with a GUI. Great for everyday use.

• rdesktop:

  rdesktop -g 1600x800 -r disk:tmp=/usr/share/windows-binaries <IP> -u <Username> -p <Password>

  This connects with a specific screen size (-g) and mounts a local folder (/usr/share/windows-binaries) as a drive on the remote system. That's powerful—you can transfer files both ways.

• xfreerdp:

  xfreerdp /u:<username> /v:<IP>:<Port>

  FreeRDP is another excellent RDP client with many features.

• Brute-force with Hydra:

  hydra -t 1 -V -f -L users.txt -P passwords.txt rdp://<IP>

  • t 1 limits to one thread (important because RDP is sensitive to multiple connections), V shows each attempt, f stops when a password is found.

• Brute-force with CrackMapExec:

  crackmapexec rdp <IP> -u users.txt -p passwords.txt

  CrackMapExec can also test credentials against RDP.

(Secure Shell Protocol - SSH)

SSH stands for Secure Shell. It is a network protocol that allows you to securely operate network services over an unsecured network. Its most common use is for remote login to computer systems by system administrators or developers.

In simple terms, using it you can open someone else's terminal remotely.

Unlike FTP, which send everything in cleartext, SSH encrypts all communication: usernames, passwords, and the session data itself.

Why it's secure:

• Encrypted Communication: SSH encrypts all transmitted data, including login passwords, executed commands, and their results. This prevents eavesdropping on the network.

• Strong Authentication: SSH supports two primary methods of authentication:
  • Password-based authentication: Uses your account and password. All data is encrypted, but this method is still vulnerable to "man-in-the-middle" attacks (you could connect to a fake server).

  • Key-based authentication (Recommended): You create a pair of keys (a public key and a private key). a private key (kept secret on your computer) and a public key (placed on any server you want to access). When you connect, you use the private key to authenticate. This method effectively prevents man-in-the-middle attacks, is much more secure, and is often used for automation scripts and single sign-on.

SSH uses a standard client-server model:

• SSH Server: The remote computer you want to connect to must be running an SSH server application (like OpenSSH's sshd). It typically listens on port 22 for incoming connections.

• SSH Client: You use an SSH client application on your local machine to initiate a connection to the server. Once the connection is established, the parties authenticate each other using passwords or keys. After successful authentication, a secure, encrypted channel is created.

Key commands:

• Password login:

  ssh <username>@<IP>

  You'll be prompted for the password.

  For example, to connect to a server with IP 192.168.1.100 as the user root:

  ssh root@192.168.1.100

• Key-based login:

  First, set proper permissions on your private key:

  chmod 600 <private_key>

  SSH is strict about permissions. If your private key is readable by anyone else, SSH refuses to use it for security.

  Then connect:

  ssh <username>@<IP> -i <private_key>

  The -i specifies which private key file to use.

  Setting Up Key-Based Authentication

• Check SSH version:

  Some older versions have vulnerabilities that allow authentication bypass or information disclosure.

  You can often see the version by connecting with a tool like Netcat or Nmap.

  Example:

  # Method 1: From outside (like an attacker would)
  nmap -sV -p 22 target-server.com
  # or
  nc target-server.com 22
  # Returns: SSH-2.0-OpenSSH_7.4

(Domain Name System - DNS)

What is DNS?

When you type www.google.com into your browser, your computer doesn't know what IP address that is. It asks a DNS server, which responds with something like 142.250.185.46. Then your browser can connect.

But DNS does much more than just translate names to IPs.

The slide lists key purposes:

• Name Resolution: The basic function—turning domain names into IP addresses.

  Example: You open a web browser and type www.google.com.

  • Without DNS: You would have to memorize and type 142.250.185.46 (IPv4) or a long hexadecimal IPv6 address every single time.

  • With DNS: Your computer asks the DNS server, "What is the IP for www.google.com?" The DNS server replies with 142.250.185.46. Your browser then connects.

  • The Result: Seamless, human-friendly browsing.

• Centralized Management: DNS makes it easy to find resources. Instead of remembering that the printer is at 192.168.1.50, you just connect to printer.company.local.

  Example: In an office, you don't want employees walking around with a sticky note full of IP addresses. You want them to access resources by a consistent name that IT can manage centrally.

  • The Scenario: The Accounting department needs to use a network scanner and a shared drive.

  • Without Centralized DNS:
    • The Scanner is at 10.10.50.10.

    • The File Server is at 10.10.50.25.

    • Users would need to map drives manually using these numbers.

  • With Centralized DNS:
    • IT creates a DNS record pointing scanner.accounting.company.local to 10.10.50.10.

    • IT creates a record pointing files.accounting.company.local to 10.10.50.25.

  • The Result: Users type \\files.accounting.company.local\sharedfolder into their computer. If IT moves the file server to a new IP address (10.10.50.30), they simply update the DNS record. The users don't have to change anything; they keep typing the same name.

• Network Efficiency: DNS allows for delegation of authority, which means you don't have one giant list of every computer on earth; you have a tree where different people manage their own branches.

  Example: A massive multinational corporation has branches in the USA, Europe, and Asia.

  • Inefficient Model: One single DNS server in New York trying to manage records for 100,000 computers across the globe. (Slow, high latency, single point of failure).

  • Efficient (Hierarchical) Model:
    • The company creates a domain structure: headquarters.globalcompany.com, europe.globalcompany.com, and asia.globalcompany.com.

    • They set up DNS servers in Europe that are the authority for anything ending in europe.globalcompany.com.

  • The Result:
    • A computer in Paris asking for printer.paris.europe.globalcompany.com is directed to the local DNS servers in Europe.

    • The IT team in Asia can update their own servers (adding/removing local printers) without needing permission from, or bothering, the central IT team in New York.

Why attackers love DNS:

DNS servers know a lot about an organization's internal structure. If an attacker can query an internal DNS server, they can discover:

• Domain controllers

• Mail servers

• Web servers

• Printers

• Internal application names

• Potentially, naming conventions that reveal information about the network"

(DNS Hierarchy)

This slide shows the DNS hierarchy, which is crucial to understanding how DNS works and what information is available."

Let me draw this for you:

                                [Root] (.)
                                   |
                           [Top-Level Domains]
                         .com  .org  .net  .edu
                                   |
                        [Second-Level Domain]
                             example.com
                                   |
                              [Subdomains]
                             www.example.com
                            mail.example.com
                            admin.example.com

• Root (.) :
  • Function: This is the very beginning of the DNS hierarchy. When a DNS resolver (like your ISP's server) doesn't have a domain cached, it starts its query at the root.

  • There are 13 sets of root servers worldwide, managed by different organizations.

  • to handle the massive traffic of the entire internet, these 13 logical servers are backed by hundreds of physical servers distributed around the globe.

  • They don't know the IP address for www.google.com, but they know exactly where to send the resolver to find the .com servers.

• Top-Level Domains (TLDs): These are the .com, .org, .net, .edu, and country codes like .uk, .jp, .de. Each TLD has its own nameservers that know about domains within that TLD.

• Second-Level Domain: This is what you register—like example.com. The nameservers for example.com know all the subdomains and records for that domain.

• Subdomains: These are prefixes added to your domain, like www.example.com, mail.example.com, or dev.example.com.

What Happens During a DNS Request?

If a computer wants to find dev.example.com:

• The Root (.): The resolver asks the root server. It responds: "I don't know dev.example.com, but I know who manages .com. Go there."

• The TLD (.com): The resolver asks the .com TLD server. It responds: "I don't know dev.example.com, but I know who manages example.com. Go there."

• The Second-Level (example.com): The resolver asks the nameserver for example.com. It looks at its records and responds: "dev is a subdomain. Here is the IP address for dev.example.com."

• The Subdomain (dev): The connection is made.

Why this matters for reconnaissance: If you can get a list of all subdomains for a target, you've discovered their entire internet-facing infrastructure. Tools like dnsrecon, dnsenum, and even search engines can help find subdomains."

(DNS Records and Enumeration)

Common DNS record types:

• A Record: Maps a hostname to an IPv4 address. www.example.com -> 192.0.2.1

• AAAA Record: Maps a hostname to an IPv6 address.

• MX Record (Mail Exchange): Specifies the mail servers for the domain. This tells you where email is handled.

• NS Record (Name Server): Specifies the authoritative nameservers for the domain.

• CNAME Record (Canonical Name): An alias. blog.example.com might be a CNAME pointing to example.github.io.

• TXT Record: Holds arbitrary text. Often used for verification (like proving you own a domain to Google) or for security policies like SPF (Sender Policy Framework) that help prevent email spoofing.

• SOA Record (Start of Authority): Contains administrative information about the zone—the primary nameserver, the administrator's email, and timing parameters.

What attackers look for:

• MX records reveal email servers—potential targets.

• TXT records can reveal security policies or even accidental information leaks.

• NS records tell you who hosts their DNS—maybe that provider has vulnerabilities.

• Subdomains discovered through enumeration can reveal development servers, test environments, or forgotten systems that might be less secure."

(DNS Enumeration)

dig ANY @<DNS_IP> <DOMAIN>

Let's break this command down:

• dig: The 'Domain Information Groper'—a powerful DNS lookup tool on Linux.

• ANY: This tells dig to request all record types. Instead of asking just for A records or just for MX records, you're asking 'give me everything you have about this domain.'

• @<DNS_IP>: This specifies which DNS server to query. You can use a public DNS like @8.8.8.8 (Google's DNS) to see what the public internet sees. Or if you have an internal DNS server IP, you can query that to see internal records.

• <DOMAIN>: The domain you're investigating.

Example: dig ANY @8.8.8.8 example.com

What you might get back:

• The A record (IP address)

• The MX records (mail servers)

• The NS records (nameservers)

• Any TXT records

• The SOA record

• Possibly other records you didn't know existed

Why this is powerful: One command can reveal the entire public DNS configuration of a target domain. From there, you can start investigating each discovered server, each mail server, each nameserver.