Attacking Common Services - DNS


Find all available DNS records for the “inlanefreight.htb” domain on the target name server and submit the flag found as a DNS record as the answer.


I’ve been stuck on this one for a few days now.
Here are my dns configs


Dig - Response is the same for every subdomain

ANY help would be greatly appreciated!

Hi, try adding an /etc/hosts entry with each subdomain you want to use.

E.g. ns1.inlanefreight.htb

Hope this helps, Mika

Yup! Got it later the same day!

I’ve seen the same thing on the .com domain, but this is a flag from something else.
So dont stray into other domains, the question specifically asks for the “inlanefreight.HTB” domain.

You were supplied with a IP address, what does this host do? Hint: As MikolasCage said before, use the /etc/hosts file for EACH subdomain.

The rest is up to you, good luck :wink:

1 Like

Yup! Got it the same day. This is my subbrute command. SPOILERS


./ inlanefreight.htb -s ./names.txt -r ./resolvers.txt

Thank you! I got it the same day, felt so dumb afterwards, but hey, that’s the learning experience!

I feel dumber. I have tried EVERYTHING on these forums, yet I keep getting a connection timeout. I get all the subdomains, I modified the /etc/hosts file, tried like hundreds of combinations of dig (dig axfr/AXFR/ANY/TXT) and nothing, I want to believe there’s something wrong with my pwnbox because honestly it has been like 2 days and nothing shows up what do I do :frowning:

It’s just because, this is proably the worst skill assessment ever made by this platform, I just lose less than an hour to solve it, but it has nothing to do with learning