19. Information Gathering and Scanning
19.2 whois and dig
whois asks registration databases who owns a domain or IP block: registrar, creation/expiry dates, name servers, and (often privacy-masked) contact data. The protocol is plain text on TCP port 43.
whois example.com # reserved documentation domain – safe to read
whois -h <server> <query> # ask a specific whois server
Fields to read: Registrar, Creation Date, Registry Expiry Date, Name Server, DNSSEC, and for IP blocks NetRange/CIDR and OrgName. Attackers use them to find name servers to query, expiring domains to take over, and related domains registered by the same organisation.
dig is the DNS Swiss knife. DNS basics aapan Part 1 madhe shiklo; aata tech records attacker chya najrene baghuya. Pratyek record kahi tari sangto: MX = mail server, TXT = SPF/verification tokens, NS = kontya server la vicharaycha.
dig @192.168.56.20 lab.local A # ask the lab DNS server directly
dig @192.168.56.20 lab.local MX +short # just the answer
dig @192.168.56.20 lab.local NS
dig @192.168.56.20 lab.local TXT
dig @192.168.56.20 www.lab.local +short # a single host
dig @192.168.56.20 version.bind chaos txt # BIND often reveals its version
dig @192.168.56.20 lab.local AXFR # zone transfer: dump the WHOLE zone
| Record | What recon learns |
|---|---|
| A / AAAA | IP addresses of hosts |
| MX | Mail servers (phishing and mail attacks target these) |
| NS | Authoritative servers to query (and try AXFR on) |
| TXT | SPF/DMARC policy, cloud verification tokens |
| CNAME | Aliases – dangling ones enable subdomain takeover |
| AXFR | If allowed, every hostname in the zone at once |
Read a dig answer in three parts: the status: in the header (NOERROR, NXDOMAIN = name does not exist, REFUSED = server will not answer you), the ANSWER SECTION (the records), and the footer (SERVER: tells you which server actually answered). A zone transfer (AXFR) is meant only for secondary DNS servers. If any client is allowed, one command gives an attacker the full map – dev, vpn, mail, everything.
How defenders reduce and detect it: turn on registrar privacy, use a role mailbox, enable registrar lock, DNSSEC and auto-renew (whois). Restrict AXFR to the secondary servers' IPs (allow-transfer { 192.168.56.21; }; or TSIG keys), hide the version (version "not disclosed"; in BIND options), disable open recursion, remove dangling CNAMEs, and alert on AXFR requests and bursts of NXDOMAIN answers (a sign of subdomain brute forcing) in DNS logs.
Ravindra Bagale's Tip
Students run dig lab.local and forget @192.168.56.20 – then the query goes to your normal resolver, you get "NXDOMAIN", and they say "the lab isn't working". Always look at the SERVER: line in the footer – it shows which server gave the answer. And if AXFR fails, that's a good sign, not a bug.
Ravindra Bagale's Tip – मराठी
Students dig lab.local चालवतात आणि @192.168.56.20 विसरतात – मग query तुमच्या normal resolver कडे जाते आणि "NXDOMAIN" येतं, आणि ते म्हणतात "lab चालत नाही". नेहमी footer मधली SERVER: line बघा – उत्तर कोणत्या server ने दिलं ते तिथे दिसतं. आणि AXFR fail झालं तर ते चांगलं लक्षण आहे, bug नाही.
Ravindra Bagale's Tip – हिंदी
Students dig lab.local चलाते हैं और @192.168.56.20 भूल जाते हैं – फिर query तुम्हारे normal resolver के पास जाती है, "NXDOMAIN" आता है, और वे कहते हैं "lab नहीं चल रहा". हमेशा footer की SERVER: line देखो – जवाब किस server ने दिया वह वहाँ दिखता है. और AXFR fail हो तो यह अच्छा संकेत है, bug नहीं.
Lab
dig against the lab BIND server. From Kali (192.168.56.10) run every dig command above against 192.168.56.20. Save the AXFR output to ~/labs/metasploitable/axfr.txt and list every hostname it leaked, plus the BIND version from the chaos query. Now fix it: on Metasploitable 2 change the zone line to allow-transfer { none; };, add version "not disclosed"; inside the options { } block of /etc/bind/named.conf.options, run sudo named-checkconf, then sudo /etc/init.d/bind9 restart. Repeat the AXFR and version queries from Kali – you should now see Transfer failed and no version. Bonus (whois format practice, still inside the lab): on Metasploitable 2 run printf "Domain Name: LAB.LOCAL\nRegistrar: Lab Registrar\nName Server: NS1.LAB.LOCAL\n" | sudo nc -l -p 43 and from Kali run whois -h 192.168.56.20 lab.local.