Yop - DNS/Bind

DNSenum - Informations DNS

Yannick — Sun, 29 Jun 2008 00:10:00 +0200

DNSenum permet de récupérer rapidement pas mal d'informations DNS sur un domaine donné.

En plus d'informations "basiques" comme les MX etc.. il permet également de faire des recherches sur Google ainsi que de la BruteForce...

Il s'uffit d'installer quelques libs comme libtest-www-mechanize-perl et libnet-netmask-perl...

Et comme un screenshot résume souvent mieux:

/!\ Trop de requètes sur Google peut provoquer un blacklistage temporaire.

fpdns - DNS server fingerprinting tool

Yannick — Tue, 20 Nov 2007 00:33:00 +0100

Script perl permettant de fingerprinter un serveur DNS.

sudo apt-get install fpdns

$ fpdns -D isc.org
fingerprint (isc.org, 192.228.91.19): ISC BIND 9.2.3rc1 -- 9.4.0a0
fingerprint (isc.org, 192.228.90.19): ISC BIND 9.2.3rc1 -- 9.4.0a0
fingerprint (isc.org, 192.228.89.19): ISC BIND 9.2.3rc1 -- 9.4.0a0
fingerprint (isc.org, 204.152.184.64): ISC BIND 9.2.3rc1 -- 9.4.0a0
fingerprint (isc.org, 2001:4f8:0:2:0:0:0:13): No match found
$

Changement d'adresse IP pour le serveur root L

Yannick — Wed, 07 Nov 2007 13:21:00 +0100

http://blog.icann.org/?p=227

This is [...] notice that there is a [...] change to the IP address for one of the authorities listed for the DNS root zone.
The change is to L.ROOT-SERVERS.NET, [...] The new IPv4 address for this authority is 199.7.83.42. [...]
It will replace the previous IP address of 198.32.64.12. [...]
It is expected that the old address will continue to work for at least six months after the transition, but will ultimately be retired from service.

Il va y avoir du fichier named.ca à modifier...

Serveurs DNS simples à mémoriser

Yannick — Sat, 13 Oct 2007 02:41:00 +0200

Que la personne qui ne s'est jamais retrouvé à devoir se rappeller l'IP d'un serveur DNS, ne serait ce que pour rechercher celui du provider, me jette la première RJ45 ??

4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6

$ dig example.com @4.2.2.4 +short
208.77.188.166
$

Si quelqu'un connait d'autres IPs simples à mémoriser ?

Dnstracer - Tracer la chaine de résolution DNS

Yannick — Thu, 30 Aug 2007 18:58:00 +0200

Présentation

dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.

Cela ressemble un peu à l'option +trace de dig

Exemple en indiquant que l'on part des serveurs root ( -s . ) en ipv4 ( -4 ) sans cache ( -c )

$ dnstracer google.com -s . -4 -c | head -15
Tracing to google.coma via A.ROOT-SERVERS.NET, maximum of 3 retries
A.ROOT-SERVERS.NET . (198.41.0.4)
|\___ J.GTLD-SERVERS.NET [com] (192.48.79.30)
| |\___ ns4.google.com [google.com] (216.239.38.10) Got authoritative answer
| |\___ ns3.google.com [google.com] (216.239.36.10) Got authoritative answer
| |\___ ns2.google.com [google.com] (216.239.34.10) Got authoritative answer
| \___ ns1.google.com [google.com] (216.239.32.10) Got authoritative answer
|\___ I.GTLD-SERVERS.NET [com] (192.43.172.30)
| |\___ ns4.google.com [google.com] (216.239.38.10) Got authoritative answer
| |\___ ns3.google.com [google.com] (216.239.36.10) Got authoritative answer
| |\___ ns2.google.com [google.com] (216.239.34.10) Got authoritative answer
| \___ ns1.google.com [google.com] (216.239.32.10) Got authoritative answer
|\___ H.GTLD-SERVERS.NET [com] (192.54.112.30)
| |\___ ns4.google.com [google.com] (216.239.38.10) Got authoritative answer
| |\___ ns3.google.com [google.com] (216.239.36.10) Got authoritative answer
$

Détection des "Lame servers"

It detects so called lame servers, which are name-servers which has been told to have information about a certain domain, but don't have this information.

$ dnstracer example.com -s . -4 -c -o
Tracing to example.coma via A.ROOT-SERVERS.NET, maximum of 3 retries
A.ROOT-SERVERS.NET . (198.41.0.4)
|\___ D.GTLD-SERVERS.NET [com] (192.31.80.30)
| |\___ dns1.example.com [example.com] (1.1.1.1)Got authoritative answer
| |\___ dns2.example.com [example.com] (2.2.2.2) Got authoritative answer
| |\___ dns3.example.com [example.com] (3.3.3.3) Lame server
| |\___ dns4.example.com [example.com] (4.4.4.4) Got authoritative answer
| \___ dns5.example.com [example.com] (5.5.5.5) Lame server
|\___ C.GTLD-SERVERS.NET [com] (192.26.92.30) ...

La réponse est "Refers backwards" si le serveur ne contient pas la donnée (et donc répond d'aller voir un des serveurs de niveau supérieur.) Ce qui est génant vu que justement c'est les serveurs de niveaux supérieurs qui pointent vers lui :)

La réponse est "Lame server" si le serveur contient la donnée demandée mais n'a pas authorité sur la zone. C'est le cas si le serveur a eu une requête récursive lui demandant de trouver l'info et l'a mise en cache.

Dig

Yannick — Wed, 29 Aug 2007 19:41:00 +0200

Quelques petites options de dig histoire d'ouvrir la nouvelle catégorie "DNS/Bind"

Version de Bind

$ dig @ns-ext.isc.org. chaos txt version.bind +short
"9.4.1-P1"
$
$ dig @ns-ext.isc.org. chaos txt authors.bind +short | head -2
"Bob Halley"
"David Lawrence"
$
$ dig @ns-ext.isc.org. chaos txt hostname.bind +short
"ns-ext.pao1.isc.org"
$

Transfert de zone

$ dig axfr @raff.debian.org. debian.org | head -10

; <<>> DiG 9.3.4 <<>> axfr @raff.debian.org. debian.org
; (1 server found)
;; global options: printcmd
debian.org. 3600 IN SOA samosa.debian.org. hostmaster.debian.org. 2007081601 10800 3600 604800 3600
debian.org. 3600 IN A 192.25.206.10
debian.org. 3600 IN MX 0 master.debian.org.
debian.org. 3600 IN NS raff.debian.org.
debian.org. 3600 IN NS rietz.debian.org.
debian.org. 3600 IN NS klecker.debian.org.
$

Suivre la chaîne de résolution ( +trace)

$ dig www.isc.org +trace

; <<>> DiG 9.3.4 <<>> www.isc.org +trace
;; global options: printcmd
. 3561749 IN NS d.root-servers.net.
. 3561749 IN NS a.root-servers.net.
. 3561749 IN NS l.root-servers.net.
. 3561749 IN NS c.root-servers.net.
. 3561749 IN NS m.root-servers.net.
. 3561749 IN NS h.root-servers.net.
. 3561749 IN NS f.root-servers.net.
. 3561749 IN NS e.root-servers.net.
. 3561749 IN NS j.root-servers.net.
. 3561749 IN NS i.root-servers.net.
. 3561749 IN NS g.root-servers.net.
. 3561749 IN NS k.root-servers.net.
. 3561749 IN NS b.root-servers.net.
;; Received 436 bytes from 192.168.1.1#53(192.168.1.1) in 46 ms

org. 172800 IN NS TLD3.ULTRADNS.org.
org. 172800 IN NS TLD4.ULTRADNS.org.
org. 172800 IN NS TLD5.ULTRADNS.INFO.
org. 172800 IN NS TLD6.ULTRADNS.CO.UK.
org. 172800 IN NS TLD1.ULTRADNS.NET.
org. 172800 IN NS TLD2.ULTRADNS.NET.
;; Received 343 bytes from 128.8.10.90#53(d.root-servers.net) in 123 ms

isc.org. 86400 IN NS ns-ext.sth1.isc.org.
isc.org. 86400 IN NS ns-ext.nrt1.isc.org.
isc.org. 86400 IN NS ns-ext.lga1.isc.org.
isc.org. 86400 IN NS ns-ext.isc.org.
;; Received 192 bytes from 199.7.66.1#53(TLD3.ULTRADNS.org) in 126 ms

www.isc.org. 600 IN A 204.152.184.88
isc.org. 3600 IN NS ns-ext.isc.org.
isc.org. 3600 IN NS ns-ext.lga1.isc.org.
isc.org. 3600 IN NS ns-ext.nrt1.isc.org.
isc.org. 3600 IN NS ns-ext.sth1.isc.org.
;; Received 236 bytes from 192.228.89.19#53(ns-ext.sth1.isc.org) in 78 ms
$

Nom associé à une IP

$ dig -x 204.152.184.88 +short
external.isc.org.
$

Requête itérative (non récursive)

$ dig mx isc.org @monserveurDNS +norec

; <<>> DiG 9.3.4 <<>> mx isc.org @monserveurDNS +norec
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48381
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;isc.org. IN MX

;; AUTHORITY SECTION:
org. 59611 IN NS tld3.ultradns.org.
org. 59611 IN NS tld4.ultradns.org.
org. 59611 IN NS tld5.ultradns.info.
org. 59611 IN NS tld6.ultradns.co.uk.
org. 59611 IN NS tld1.ultradns.net.
org. 59611 IN NS tld2.ultradns.net.

;; ADDITIONAL SECTION:
tld3.ultradns.org. 59611 IN A 199.7.66.1
tld4.ultradns.org. 59611 IN A 199.7.67.1
tld5.ultradns.info. 59611 IN A 192.100.59.11
tld6.ultradns.co.uk. 59611 IN A 198.133.199.11
tld1.ultradns.net. 59611 IN A 204.74.112.1
tld2.ultradns.net. 59611 IN A 204.74.113.1

;; Query time: 1 msec
;; SERVER: monserveurDNS#53(monserveurDNS)
;; WHEN: Wed Jan 01 01:01:01 2007
;; MSG SIZE rcvd: 283

La même requête récursive (par défaut)

$ dig mx isc.org @monserveurDNS

; <<>> DiG 9.3.4 <<>> mx isc.org @monserveurDNS
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25492
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;isc.org. IN MX

;; ANSWER SECTION:
isc.org. 3249 IN MX 10 mx.isc.org.
isc.org. 3249 IN MX 15 mx.sth1.isc.org.

;; ADDITIONAL SECTION:
mx.isc.org. 3249 IN A 204.152.184.167
mx.sth1.isc.org. 3249 IN A 192.228.89.21

;; Query time: 5 msec
;; SERVER: monserveurDNS#53(monserveurDNS)
;; WHEN: Wed Jan 01 01:01:01 2007
;; MSG SIZE rcvd: 100
$

Simplifier la lecture des valeurs du SOA (+multiline)

$ dig soa isc.org. @ns-ext.isc.org. +multiline
(extrait)
isc.org. 3600 IN SOA ns-int.isc.org. hostmaster.isc.org. (
2007090900 ; serial
7200 ; refresh (2 hours)
3600 ; retry (1 hour)
24796800 ; expire (41 weeks)
3600 ; minimum (1 hour)
)

Alors qu'un

$ dig soa isc.org. @ns-ext.isc.org.
(extrait)
isc.org. 3600 IN SOA ns-int.isc.org. hostmaster.isc.org. 2007090900 7200 3600 24796800 3600