Hola,alguien sabe para que sirve saber informacion de un dns en un proceso de pentesting,por ejmplo los registros,subdominos,mail servers y la transferencia de zona?
Saludos!
Ejemplo:
----- record.com.mx -----
Host's addresses:
__________________
record.com.mx. 2845 IN A 176.28.117.196
Name Servers:
______________
dnsmx1.notmusa.com.mx. 3600 IN A 201.151.194.160
dnsmx3.notmusa.com.mx. 3600 IN A 189.206.61.12
dnsmx2.notmusa.com.mx. 3600 IN A 201.151.194.190
Mail (MX) Servers:
___________________
mail2.record.com.mx. 3600 IN A 148.243.100.12
mail.record.com.mx. 3600 IN A 201.151.194.12
Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for record.com.mx on dnsmx1.notmusa.com.mx ...
AXFR record query failed: Response code from server: REFUSED
Trying Zone Transfer for record.com.mx on dnsmx3.notmusa.com.mx ...
record.com.mx. 3600 IN SOA dnsmx1.notmusa.com.mx.
record.com.mx. 3600 IN NS dnsmx1.notmusa.com.mx.
record.com.mx. 3600 IN NS dnsmx2.notmusa.com.mx.
record.com.mx. 3600 IN NS dnsmx3.notmusa.com.mx.
record.com.mx. 3600 IN A 176.28.117.196
record.com.mx. 3600 IN MX 10
record.com.mx. 3600 IN MX 20
record.com.mx. 86400 IN TXT "v=spf1
blogs.record.com.mx. 3600 IN A 174.123.2.163
cms.record.com.mx. 3600 IN A 107.21.218.231
digital.record.com.mx. 3600 IN A 201.151.194.4
encuestabalon.record.com.mx. 3600 IN A 201.151.194.4
encuestainterna.record.com.mx. 3600 IN A 201.151.194.4
estadisticas.record.com.mx. 3600 IN A 174.123.2.163
evaluacion08.record.com.mx. 3600 IN A 201.151.194.4
foros.record.com.mx. 3600 IN A 74.81.84.78
gana25dolares.record.com.mx. 3600 IN A 201.151.194.4
imagenes.record.com.mx. 3600 IN CNAME B30852.cdn.telefonica.com.
laquiniela.record.com.mx. 3600 IN A 201.151.194.4
mail.record.com.mx. 3600 IN A 201.151.194.12
mail2.record.com.mx. 3600 IN A 148.243.100.12
mailservice.record.com.mx. 3600 IN A 205.251.132.32
movil.record.com.mx. 3600 IN CNAME ec2-54-200-191-21.us-west-2.compute.amazonaws.com.
multimedia.record.com.mx. 3600 IN CNAME B30846.cdn.telefonica.com.
pop.record.com.mx. 3600 IN A 201.151.194.12
record4.record.com.mx. 3600 IN A 107.21.218.231
regio.record.com.mx. 3600 IN CNAME ec2-54-200-191-21.us-west-2.compute.amazonaws.com.
revistas.record.com.mx. 3600 IN A 201.151.194.4
smtp.record.com.mx. 3600 IN A 201.151.194.12
stats.record.com.mx. 3600 IN CNAME B30844.cdn.telefonica.com.
www.record.com.mx. 3600 IN CNAME B30842.cdn.telefonica.com.
Trying Zone Transfer for record.com.mx on dnsmx2.notmusa.com.mx ...
record.com.mx. 3600 IN SOA dnsmx1.notmusa.com.mx.
record.com.mx. 3600 IN A 176.28.117.196
record.com.mx. 86400 IN TXT "v=spf1
record.com.mx. 3600 IN MX 10
record.com.mx. 3600 IN MX 20
record.com.mx. 3600 IN NS dnsmx1.notmusa.com.mx.
record.com.mx. 3600 IN NS dnsmx2.notmusa.com.mx.
record.com.mx. 3600 IN NS dnsmx3.notmusa.com.mx.
blogs.record.com.mx. 3600 IN A 174.123.2.163
cms.record.com.mx. 3600 IN A 107.21.218.231
digital.record.com.mx. 3600 IN A 201.151.194.4
encuestabalon.record.com.mx. 3600 IN A 201.151.194.4
encuestainterna.record.com.mx. 3600 IN A 201.151.194.4
estadisticas.record.com.mx. 3600 IN A 174.123.2.163
evaluacion08.record.com.mx. 3600 IN A 201.151.194.4
foros.record.com.mx. 3600 IN A 74.81.84.78
gana25dolares.record.com.mx. 3600 IN A 201.151.194.4
imagenes.record.com.mx. 3600 IN CNAME B30852.cdn.telefonica.com.
laquiniela.record.com.mx. 3600 IN A 201.151.194.4
mail.record.com.mx. 3600 IN A 201.151.194.12
mail2.record.com.mx. 3600 IN A 148.243.100.12
mailservice.record.com.mx. 3600 IN A 205.251.132.32
movil.record.com.mx. 3600 IN CNAME ec2-54-200-191-21.us-west-2.compute.amazonaws.com.
multimedia.record.com.mx. 3600 IN CNAME B30846.cdn.telefonica.com.
pop.record.com.mx. 3600 IN A 201.151.194.12
record4.record.com.mx. 3600 IN A 107.21.218.231
regio.record.com.mx. 3600 IN CNAME ec2-54-200-191-21.us-west-2.compute.amazonaws.com.
revistas.record.com.mx. 3600 IN A 201.151.194.4
smtp.record.com.mx. 3600 IN A 201.151.194.12
stats.record.com.mx. 3600 IN CNAME B30844.cdn.telefonica.com.
www.record.com.mx. 3600 IN CNAME B30842.cdn.telefonica.com.
brute force file not specified, bay.
Con eso sabes cuales paginas webs se encuentran dentro del mismo servidor, en el pentest sirve para poder realizar algun tipo de ataque he intentar rootear el servidor de una de ellas para llegar ala pagina que buscas, o simplemente intentar realizar symlink... salu2
Mx Mail Relay obtencion y acceso a cuentas corporativa aportando a lo que dijo el amigo thusu ;).
Regards,
Snifer