37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.7 DNS Enumeration
DNS basics Chapter 3/19 madhe shiklo. Enumeration view: records dump, subdomain lists, zone transfer (AXFR).
# Records
dig @192.168.56.20 lab.local ANY
dig @192.168.56.20 lab.local NS
dig @192.168.56.20 lab.local MX
nslookup lab.local 192.168.56.20
# Zone transfer – if allowed, FULL map leaks
dig @192.168.56.20 lab.local AXFR
# Tool concepts (lab domain only)
sudo apt install -y dnsenum fierce
dnsenum --dnsserver 192.168.56.20 lab.local
# fierce / similar: subdomain wordlist against YOUR lab domain only
Jar AXFR allow asel – ek command madhe saglya hostnames. Chapter 19 madhe fix pan shiklo (allow-transfer).
Defence: AXFR fakt secondary DNS IPs (TSIG); split DNS (internal vs public); no version disclosure; rate-limit / alert on AXFR + NXDOMAIN bursts; remove stale records. Samjla ka?
Ravindra Bagale's Tip
Students get upset when AXFR fails. A failure means the server is hardened – that's good. In an exam or interview, "AXFR refused" is a positive finding for the defender. Subdomain brute force is still possible – so keep monitoring in place as well.
Ravindra Bagale's Tip – मराठी
Students AXFR fail झाले की दुःखी होतात. Fail = server hardened – चांगले. Exam/interview मध्ये "AXFR refused" हे defender साठी positive finding. Brute force subdomain तरीही शक्य – म्हणून monitoring पण ठेवा.
Ravindra Bagale's Tip – हिंदी
Students AXFR fail होने पर दुखी हो जाते हैं. Fail = server hardened – अच्छा. Exam/interview में "AXFR refused" defender के लिए positive finding है. Subdomain brute force फिर भी संभव है – इसलिए monitoring भी रखो.
Lab
Chapter 19 sarkhe: dig @192.168.56.20 lab.local AXFR – transfer succeed ki fail? Succeed asel tar host list save kara ani BIND madhe allow-transfer { none; }; + restart (lab). Fail asel tar defence already OK – dnsenum ne lab domain var record list compare kara.