So I am asking this question cause I have been stuck in this situation a few times while carrying out pen tests. A few times I find an IP with DNS service up and running and I am not able to find out what domain this IP is serving. I can do all the basic stuff like enumerating its version, dns cache snooping and all. I can even do a reverse resolution for the total IP range in which that IP falls into, basic whois stuff to gather the most likely domain that DNS server does resolution for. Still then in a few cases I end up with nothing. It also might be the case that its in a different mode of operation. Either way, are there any known testing techniques you guys know that can pinpoint the domain a given DNS server resolves for or what mode it is operating in.
For example:-
Default Server: UnKnown
Address: 10.211.55.1
server x.x.x.x
Default Server: [x.x.x.x]
Address: x.x.x.x
set type=any
domain.com (all domains found through reconnaissance)
Server: [x.x.x.x]
Address: x.x.x.x
*** [x.x.x.x] can't find test.com: Query refused
Even after I go through a list of all the domains I find through recon exercises, I have nothing. Are there known techniques to find out what the server x.x.x.x will resolve for?
Please let me know if my question still needs clarity.
Thanks