-: Domain Name Service Harvesting or DNS Harvesting.
So, why would we want to use DNS to gather information?
Well, this is often our first step in gathering
information because it's gonna give us a lot of
publicly available information because we can get
the DNS information from many public servers.
By the way the DNS works, it has to talk
to other servers outside of it's network
to publish it's Domain Name Service
and IP address, so people know where to find its servers.
So a quick Whois search can give you many, many
details you can use as well as beyond the IP
address and the name of the server, but also
things like who registered it, their actual address,
emails, phone numbers and other information.
Hostnames can tell you about the server itself.
For instance, if I had DC1.jasondion.com, what kind
of server might that be?
Well if it's DC, it's probably a Windows
domain controller, right?
If I had EX01, it's probably an exchange server, right?
If I had mail.jasondion.com, it's probably a mail server.
All those types of things are dead giveaways
that make it easier for you to figure out what
exploits you're gonna throw if you're doing
a penetration test or looking at it from what a
bad guy might see.
Now, one of the ways you can find your information
on DNS is doing something called nslookup and
in every version of Windows and Unix and Linux
and Macintosh, there is a program called nslookup.
Go to your command prompt in your terminal,
type in nslookup and then type in the website you
wanna learn, like Cysco.com and it will come back
and tell you what that IP address is or here we had
DLINK.com and the IP address for that.
So that's a very simple way of looking it up,
but you can get more information with nslookup as well.
Now, some of the things that you're gonna find inside
the DNS is one of 4 DNS records.
There's an MX record, which is for mail servers.
An A record, for address records,
like, www.jasondion.com.
C which is canonical records and PTR which are your
pointer records, which will actually point
from one site to the other.
These are the basic type of DNS records.
The ones you really need to focus on are A records
and MX records for this course and for the CSA+ exam.
Now, when we talk about trace route, trace route
is actually gonna trace the system from your host
all the way through to the destination.
So, if I'm doing a trace route of 209.85.135.99,
as you see with the red arrow there.
You can see that it's gonna go out all the way
to Google, right?
Because that's what that IP address was for
and its gonna start at 192.168.1.1. which is
my router.
It has a request time out, which goes to a firewall,
and then it goes out to the next thing, which is
172.29.something.something, which is another
internal network.
And then it hits the next router, which is the ISP.
And then it goes to another router, and another router,
and another router and another router and finally at
router 11 it finally finds its destination
of Google.com, right?
We can also trace route it by going to www.google.com
because we can do it with IP address or with the name
and we'll get the same results as it finds its way
through the internet.
And that's the idea here from a very simply overview
of the beginning of DNS Harvesting, which is IP
addresses and Domain Names.
We're gonna go a little bit further in this
in the next lecture.