# DNS (53)

<details>

<summary>Protocol Information</summary>

The DNS system is responsible for translating human-readable hostnames into machine-readable IP addresses, and vice versa.

**`DNS recursive resolver`** is activated, which makes several requests:\
\- Root Name Server *(are 13)*\
*-* Top Level Domain *(.com, .it,* [*CountryCode*](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)*, etc.)*\
*-* Authoritative Name Server *(example.com)*.

**`DNS Records`** provides specific information.\
\- <mark style="color:blue;">`NS`</mark> : Returns the DNS servers (NameServers) of the domain, responsible for the Authoritative Name Server of the zone.\
\- <mark style="color:blue;">`A`</mark> : Hostname to IPv4.\
\- <mark style="color:blue;">`AAAA`</mark> : Hostname to IPv6.\
\- <mark style="color:blue;">`PTR`</mark> : IP to Hostname.\
\- <mark style="color:blue;">`CNAME`</mark> : Associate an alias with a hostname, with the hostname associated with an A. *e.g., A for hackthebox.eu and CNAME for [www.hackthebox.eu](http://www.hackthebox.eu)*\
\- <mark style="color:blue;">`MX`</mark> : Mail Exchange, identifies hosts that will accept emails for a specific host. Returns the responsible mail servers.\
\- <mark style="color:blue;">`TXT`</mark> : Contains various textual information.\
\- <mark style="color:blue;">`ANY`</mark> : To get all records, but RFC8482 specifies that they would be dropped, so they might not respond.\
\- <mark style="color:blue;">`SOA`</mark> : It provides information about the corresponding DNS zone and the e-mail address of the administrative contact. The SOA record is found in a domain's zone file and specifies who is responsible for operating the domain and how DNS information for the domain is managed. The dot (.) is replaced by a snail symbol (@) in the email address.

</details>

## Port

<table data-header-hidden><thead><tr><th width="166">Port</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> UDP</strong></td><td>DNS (unencrypted)</td></tr><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> TCP</strong></td><td>DNS (encrypted) </td></tr></tbody></table>

## Config File

The hosts file is located at:

* **Windows**: `C:\\Windows\System32\drivers\etc\hosts`
* **Linux** e **MacOS**: `/etc/host` and `/etc/resolv.conf`

[Bind9](https://www.isc.org/bind/)

* `/etc/bind/named.conf.local`&#x20;
* `/etc/bind/named.conf.options`&#x20;
* `/etc/bind/named.conf.log`

Change DNS

{% code overflow="wrap" %}

```bash
sudo vim /etc/resolv.conf
# sudo chattr +i/-i /etc/resolv.conf
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nmcli connection # Connection Name
sudo nmcli connection modify "<CONNECTION_NAME>" ipv4.dns "<DNS1>, <DNS2>"
sudo systemctl restart NetworkManager
```

{% endcode %}

## Interact

{% tabs %}
{% tab title="Enumeration" %}
{% code overflow="wrap" %}

```bash
host -t <TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nslookup -query=<TYPE> <DOMAIN> [<DNS_SERVER>] 
nslookup -type=<TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
dig <TYPE> <DOMAIN> [@<DNS_SERVER>]
```

{% endcode %}
{% endtab %}

{% tab title="Website" %}

<table><thead><tr><th width="185">Website</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://bgp.he.net/">Hurricane Electric</a></td><td>For the enumeration of DNS TYPEs.</td></tr><tr><td><a href="https://viewdns.info/">viewDNS</a></td><td>For many specific DNS information.</td></tr><tr><td><a href="https://dnsdumpster.com/">DNSDumpster</a></td><td>Discover hosts related to a domain.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Attacks

### [Zone Transfer](https://ivalexev.gitbook.io/rednote/pentesting-process/information-gathering/active#zone-transfer)

### [Other attacks](https://securitytrails.com/blog/most-popular-types-dns-attacks#content-dns-tunneling)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/utility/service/dns-53.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.