Information gathering - Active Subdomain Enumeration - Last question

HTB Content Academy
1

Hi guys,
I need help with the last question of the mentioned lesson on the academy. The question is:
“Submit the number of all “A” records from all zones as the answer.”. So, previously, I have identified two zones:

  • inlanefreight.htb
  • internal.inlanefreight.htb

So I tried:

dig a inlanefreight.htb
dig a internal.inlanefreight.htb

I put this two FQDN in the /etc/hosts file with the related IP.

Can you help me?

2

Hey, if you are trying to count the A records, then you need to display all of the records like you did in question #2. I recommend doing what you did in question #2 for each of the domains that you listed and then just manually counting the A records in each zone.
-onthesauce

3

OK I do this but I can’t find the answer. I do the following:

  • I take the same list of the question #2;
  • For each name and address: dig a name address.

But I always receive authority and additional but no answer.

4

Hey no worries, when you transfer the zone are you not seeing the record type next to the listing?

I used dig to transfer via dig axfr and the output always contained the record type in each listing. There should be no additional need for dig, because it already gives you the record type. Then you just do what I said above.

DM me with a screenshot of your zone transfer if you are still having issues.
-onthesauce

1 Like
5

I have a dumber question. How do we find out the answer to the second question: How many zones? I managed to finish the other questions but I still don’t know how to get the answer for this one. I know that there is not a 1-to-1 mapping from subdomains to zones, so how do we know which ones are the zones?