Academy: Attacking Common Services | Attacking DNS

27

I struggled with this a lot, my best advice is to run subrute with inlanefreight.com and inlanefreight.htb then enumerate all subdomains found.

28

To obtain DNS records for a domain, you typically need to know the domain name. However, in this case, it seems that you only have the IP address of the name server and not the domain name.

One option you can try is to use a reverse DNS lookup tool to determine the domain name associated with the IP address of the name server. Once you have the domain name, you can then use a tool like nslookup or dig to query the DNS records for that domain and look for the flag.

If subbrute is not working for you, you may want to try other DNS enumeration tools such as fierce, dnsenum, or dnsmap. These tools can help you discover subdomains associated with the domain and may help you find the flag if it is hidden in one of the subdomains.

It’s important to note that DNS enumeration can be a sensitive task and should only be performed on systems that you have permission to test. Always ensure that you follow ethical and legal guidelines when conducting any type of security testing.
Regards : combination of two name to make one

1 Like
30

Timing out every time I do a zone transfer. Will not work using any combinations of axfr. It just times out even though I can ping both the NS and IP address.

1 Like
32

Great.:hushed::hushed::hushed::hushed:

1 Like
35

The module DNS section of

is a huge help. Hours wasted because its not explained properly in this module. Very poor Explanation.

I didnt know you could query the Target IP with the dig command.

37

@Alex thankyou ! Been doing this for a week now …

38

i do it , than what next ?

41

Can you tell me how have you done that?

I am really really stuck

43

For those who have problems with the zone transfer, use pwnbox instead of editing resolv.conf

44

i think i have some idea

45

If you only have the IP address of the name server and no domain, you won’t be able to retrieve DNS records directly. DNS records are associated with specific domains, so you need a domain name to query DNS records for that domain. Without the domain, you won’t have the necessary information to perform a DNS lookup.

You’ll need to obtain the domain name associated with the target name server to proceed with retrieving DNS records. This may require additional information gathering or reconnaissance to identify the domain associated with the IP address you have. Once you have the domain, you can use tools like nslookup or online DNS lookup services to retrieve DNS records for that domain.

47

I am REALLY stuck on this, I can find the “decoy” flag, and have done every thing in the module related to DNS enumeration and I still cant seem to find the real flag. Any Help Would Be Greatly Appreciated.
I have ran Subbrute- with the updated resolver.txt file.
Nslookup- keeps giving errors
Dig AXFR cant find the address.
Fierce - cant

Provably something super simple but I am stomped atm.
thanks guys/ girls

B.

48

yes, where can/ how can I find the correct flag?

49

Please check my post from Nov 22.

50

So,

  1. add ip and domain to /etc/hosts.
  2. use subbrute to find a specific subdomain. Be careful to use against inlanfreight.htb and not .com.
  3. use dig axfr agasint the subdomain you found.
2 Likes
51

Ok ill try that. I was like “is it .com or .htb? When I use .htb I get a response .com I get not response, but subbrute hasn’t worked with .htb” Thanks for the clue

52

Yeah I feel dumb. I got it. :rofl:

53

I love you… i am a big dumb dumb

54

Bro I am not still getting with htb it through some error

55

Thank you i go the Flag now