> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/utility/service/dns-53.md).

# DNS (53)

<details>

<summary>Protocol Information</summary>

The DNS system is responsible for translating human-readable hostnames into machine-readable IP addresses, and vice versa.

**`DNS recursive resolver`** is activated, which makes several requests:\
\- Root Name Server *(are 13)*\
*-* Top Level Domain *(.com, .it,* [*CountryCode*](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)*, etc.)*\
*-* Authoritative Name Server *(example.com)*.

**`DNS Records`** provides specific information.\
\- <mark style="color:blue;">`NS`</mark> : Returns the DNS servers (NameServers) of the domain, responsible for the Authoritative Name Server of the zone.\
\- <mark style="color:blue;">`A`</mark> : Hostname to IPv4.\
\- <mark style="color:blue;">`AAAA`</mark> : Hostname to IPv6.\
\- <mark style="color:blue;">`PTR`</mark> : IP to Hostname.\
\- <mark style="color:blue;">`CNAME`</mark> : Associate an alias with a hostname, with the hostname associated with an A. *e.g., A for hackthebox.eu and CNAME for [www.hackthebox.eu](http://www.hackthebox.eu)*\
\- <mark style="color:blue;">`MX`</mark> : Mail Exchange, identifies hosts that will accept emails for a specific host. Returns the responsible mail servers.\
\- <mark style="color:blue;">`TXT`</mark> : Contains various textual information.\
\- <mark style="color:blue;">`ANY`</mark> : To get all records, but RFC8482 specifies that they would be dropped, so they might not respond.\
\- <mark style="color:blue;">`SOA`</mark> : It provides information about the corresponding DNS zone and the e-mail address of the administrative contact. The SOA record is found in a domain's zone file and specifies who is responsible for operating the domain and how DNS information for the domain is managed. The dot (.) is replaced by a snail symbol (@) in the email address.

</details>

## Port

<table data-header-hidden><thead><tr><th width="166">Port</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> UDP</strong></td><td>DNS (unencrypted)</td></tr><tr><td><mark style="color:green;"><strong>53</strong></mark><strong> TCP</strong></td><td>DNS (encrypted) </td></tr></tbody></table>

## Config File

The hosts file is located at:

* **Windows**: `C:\\Windows\System32\drivers\etc\hosts`
* **Linux** e **MacOS**: `/etc/host` and `/etc/resolv.conf`

[Bind9](https://www.isc.org/bind/)

* `/etc/bind/named.conf.local`&#x20;
* `/etc/bind/named.conf.options`&#x20;
* `/etc/bind/named.conf.log`

Change DNS

{% code overflow="wrap" %}

```bash
sudo vim /etc/resolv.conf
# sudo chattr +i/-i /etc/resolv.conf
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nmcli connection # Connection Name
sudo nmcli connection modify "<CONNECTION_NAME>" ipv4.dns "<DNS1>, <DNS2>"
sudo systemctl restart NetworkManager
```

{% endcode %}

## Interact

{% tabs %}
{% tab title="Enumeration" %}
{% code overflow="wrap" %}

```bash
host -t <TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nslookup -query=<TYPE> <DOMAIN> [<DNS_SERVER>] 
nslookup -type=<TYPE> <DOMAIN> [<DNS_SERVER>]
```

{% endcode %}

{% code overflow="wrap" %}

```bash
dig <TYPE> <DOMAIN> [@<DNS_SERVER>]
```

{% endcode %}
{% endtab %}

{% tab title="Website" %}

<table><thead><tr><th width="185">Website</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://bgp.he.net/">Hurricane Electric</a></td><td>For the enumeration of DNS TYPEs.</td></tr><tr><td><a href="https://viewdns.info/">viewDNS</a></td><td>For many specific DNS information.</td></tr><tr><td><a href="https://dnsdumpster.com/">DNSDumpster</a></td><td>Discover hosts related to a domain.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Attacks

### [Zone Transfer](/rednote/pentesting-process/information-gathering/active.md#zone-transfer)

### [Other attacks](https://securitytrails.com/blog/most-popular-types-dns-attacks#content-dns-tunneling)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/utility/service/dns-53.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.