> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/utility/service/dns-53.md).

# DNS (53)

Domain Name System.

<details>

<summary>Protocol Information</summary>

The DNS system is responsible for translating human-readable hostnames into machine-readable IP addresses, and vice versa.

**`DNS recursive resolver`** is activated, which makes several requests:\
\- Root Name Server *(are 13)*\
*-* Top Level Domain *(.com, .it,* [*CountryCode*](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)*, etc.)*\
*-* Authoritative Name Server *(example.com)*.

**`DNS Records`** provides specific information.\
\- <mark style="color:blue;">`NS`</mark> : Returns the DNS servers (NameServers) of the domain, responsible for the Authoritative Name Server of the zone.\
\- <mark style="color:blue;">`A`</mark> : Hostname to IPv4.\
\- <mark style="color:blue;">`AAAA`</mark> : Hostname to IPv6.\
\- <mark style="color:blue;">`PTR`</mark> : IP to Hostname.\
\- <mark style="color:blue;">`CNAME`</mark> : Associate an alias with a hostname, with the hostname associated with an A. *e.g., A for hackthebox.eu and CNAME for [www.hackthebox.eu](http://www.hackthebox.eu)*\
\- <mark style="color:blue;">`MX`</mark> : Mail Exchange, identifies hosts that will accept emails for a specific host. Returns the responsible mail servers.\
\- <mark style="color:blue;">`TXT`</mark> : Contains various textual information.\
\- <mark style="color:blue;">`ANY`</mark> : To get all records, but RFC8482 specifies that they would be dropped, so they might not respond.\
\- <mark style="color:blue;">`SOA`</mark> : It provides information about the corresponding DNS zone and the e-mail address of the administrative contact. The SOA record is found in a domain's zone file and specifies who is responsible for operating the domain and how DNS information for the domain is managed. The dot (.) is replaced by a snail symbol (@) in the email address.

</details>

## Port

<table data-header-hidden><thead><tr><th width="166">Port</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> UDP</strong></td><td>DNS (unencrypted)</td></tr><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> TCP</strong></td><td>DNS (encrypted) </td></tr></tbody></table>

## Config File

The hosts file is located at:

* **Windows**: `C:\\Windows\System32\drivers\etc\hosts`
* **Linux** e **MacOS**: `/etc/host` and `/etc/resolv.conf`

[Bind9](https://www.isc.org/bind/)

* `/etc/bind/named.conf.local`&#x20;
* `/etc/bind/named.conf.options`&#x20;
* `/etc/bind/named.conf.log`

Change DNS

{% code overflow="wrap" %}

```bash
sudo vim /etc/resolv.conf
# sudo chattr +i/-i /etc/resolv.conf
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nmcli connection # Connection Name
sudo nmcli connection modify "<CONNECTION_NAME>" ipv4.dns "<DNS1>, <DNS2>"
sudo systemctl restart NetworkManager
```

{% endcode %}

## Interact

{% tabs %}
{% tab title="Enumeration" %}
{% code overflow="wrap" %}

```bash
host -t <TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nslookup -query=<TYPE> <DOMAIN> [<DNS_SERVER>] 
nslookup -type=<TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
dig <TYPE> <DOMAIN> [@<DNS_SERVER>]
```

{% endcode %}
{% endtab %}

{% tab title="Website" %}

<table><thead><tr><th width="185">Website</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://bgp.he.net/">Hurricane Electric</a></td><td>For the enumeration of DNS TYPEs.</td></tr><tr><td><a href="https://viewdns.info/">viewDNS</a></td><td>For many specific DNS information.</td></tr><tr><td><a href="https://dnsdumpster.com/">DNSDumpster</a></td><td>Discover hosts related to a domain.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Attacks

### [Zone Transfer](/rednote/pentesting-process/information-gathering/active.md#zone-transfer)

### [Other attacks](https://securitytrails.com/blog/most-popular-types-dns-attacks#content-dns-tunneling)