0

So I am asking this question cause I have been stuck in this situation a few times while carrying out pen tests. A few times I find an IP with DNS service up and running and I am not able to find out what domain this IP is serving. I can do all the basic stuff like enumerating its version, dns cache snooping and all. I can even do a reverse resolution for the total IP range in which that IP falls into, basic whois stuff to gather the most likely domain that DNS server does resolution for. Still then in a few cases I end up with nothing. It also might be the case that its in a different mode of operation. Either way, are there any known testing techniques you guys know that can pinpoint the domain a given DNS server resolves for or what mode it is operating in.

For example:-

Default Server: UnKnown

Address: 10.211.55.1

server x.x.x.x

Default Server: [x.x.x.x]

Address: x.x.x.x

set type=any

domain.com (all domains found through reconnaissance)

Server: [x.x.x.x]

Address: x.x.x.x

*** [x.x.x.x] can't find test.com: Query refused

Even after I go through a list of all the domains I find through recon exercises, I have nothing. Are there known techniques to find out what the server x.x.x.x will resolve for?

Please let me know if my question still needs clarity.

Thanks

Improve this question
1
  • In Bing you can search for ip:1.2.3.4
    – paj28
    Sep 13, 2016 at 11:27

1 Answer 1

Reset to default
1

If your looking for all the DNS names that are served on a particular IP Address you can use http://www.ip-neighbors.com/ or recon-ng has some modules for IP enumeration as well.

As a last resort, if you have the client's FQDN, run Fierce or another DNS brute-forcing tool and cross reference your results.

Improve this answer
4
  • Not sure if my question is clear enough; my question was not to find virtual hosts but find the dns domains a DNS serves. For example, if I find an IP with only port 53 (dns service running). The IP to websites technique wont work on this cause there will be no virtual hosts on it. And I only want to find out the domain this DNS server is resolving for.
    – vivz
    Sep 14, 2016 at 5:43
  • @vivz - As far as I know, there is no way to do that directly through the DNS protocol. So suggestions like recon-ng and brute force are the best you will get.
    – paj28
    Sep 14, 2016 at 10:14
  • 1
    Hmm.. if you're on an internal network just Wireshark the traffic filter on that IP and "DNS" and see what host names are being resolved, then use nslookup to confirm any of the DNS queries you suspect are being returned from that device (vs upstream). It's going to be a manual process, like @paj28 said, I don't think there's a tool for this.
    – HashHazard
    Sep 14, 2016 at 13:24
  • Thanks paj28 and hollowproc, but not the answers I was looking for as I was looking for a solid concept for this. Thanks anyways :)
    – vivz
    Sep 15, 2016 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.