z3tssu
  • README
  • Cybersecurity Certifications & Notes
    • Cybersecurity Knowledge Base
      • IPPSEC's Video Search for Hacking Methods
      • Finding Someone's Location with Seeker
      • Nishang Project
      • Hacktricks
    • 📜Certifications & Courses
      • 🟢Hackthebox - CPTS
        • Getting Started
          • General
          • Tmux
          • Vim
          • Service Scanning
        • Penetration Testing Process
        • Network Enumeration with Nmap
          • Host Discovery
          • Host and Port Scanning
          • Saving the Nmap Scanning Results
          • Service Enumeration
          • Nmap Scripting Engine
            • Update the Scripting Engine
            • Nmap Script Locations
          • Performance Tags
          • Firewall and IDS/IPS Evasion
        • 👣Footprinting
          • 🔎Host-Based Service Enumeration
            • FTP [21]
              • Basics
                • vsFTPd Detailed Output
                • Hiding IDs - YES
              • Footprinting FTP
                • Nmap FTP Script Scanning
                • Service Interaction
              • FTP Commands
            • SMB [139/445]
              • Basics
                • Default Configuration
                • Create and Manage Samba Share
                • smbstatus
              • Footprinting SMB
                • SMB Nmap Scan
                • Smbclient
                • RPCclient
                  • Useful Commands
                  • Basic Enumeration
                  • Enumerate Users
                  • Group Information
                  • Bruteforcing User RIDs
                • smbmap
                • CrackMapExec
                • Enum4Linux-ng
            • NFS [111,2049]
              • Basics
                • Default Configuration of NFS
                • Creating an NFS Entry
                • Dangerous Settings
              • Footprinting NFS
                • nmap
                  • Basic Scan
                  • NFS Script Scan
                • Mount an NFS Share
                • Unmount NFS
            • DNS [53]
              • Basics
                • DNS Records
                • Default Configuration
                • Dangerous Settings
              • Footprinting DNS
                • DIG - NS QUERY
                • DIG - Version Query
                • DIG - Any Query
                • DIG - AXFR Zone Transfer
                • DIG - AXFR Zone Transfer - Internal
                • Subdomain Bruteforcing (For Loop with Seclists)
                • Subdomain Bruteforce (DNSenum)
            • SMTP (25,587)
              • Telnet SMTP
                • Telnet - HELO/EHLO
                • Telnet - VRFY
                • Telnet - Send an Email
              • Nmap Telnet
              • FTP User Enumeration
            • IMAP/POP3 [110,995,143,993]
              • Default Configuration
            • SNMP[161]
            • MySQL [3306]
            • MSSQL [1433]
            • Oracle TNS [1521]
            • IPMI [623]
            • SSH [22]
            • Rsync [873]
            • R-Services [512, 513, 514]
            • RDP [3389]
            • WinRM [5985, 5986]
            • WMI [135]
          • Introduction
            • Enumeration Principles
            • Enumeration Methodology
          • Infrastructure Enumeration
            • Domain Information
            • Cloud Resource
            • Staff
        • 🕸️Web Information Gathering
          • 🤷‍♂️WHOIS
          • 🧬DNS
            • 🧬DIG
          • 📚Subdomain Enumeration
            • DNS Zone Transfer
            • Sub Domain Bruteforcing
            • Virtual Hosts
              • Gobuster vhosts brutefoce
              • Add Vhosts to /etc/hosts
            • Certificate Transparency Logs
          • 🖐️Fingerprinting
            • Banner Grabbing
            • Web Application Firewall (Wafw00f)
            • Nikto
          • Crawling
            • robots.txt
            • .Well-Known URIs
            • Popular Web-Crawlers
              • Scrapy (ReconSpider)
              • Apache Nutch (Scalable Crawler)
              • Burp Suite Spider
              • OWASP ZAP (ZED Attack Proxy)
          • 🔥Automating Recon
            • FinalRecon
          • 🔍Search Engine Discovery
            • 🔍Google Dorking
            • 🔍Search Operators
          • Web Archives
          • Questions
            • Question 4
            • Question 5
        • Vulnerability Assessment
          • Vulnerability Scanning Tools
            • Nessus
              • Installing and Starting Nessus
              • Nessus Scan Types
              • Nessus Polices
                • Creating a Nessus Policy
              • Nessus Plugins
                • Creating a Plugin Rule
              • Credentialed Scanning
                • HTB Credentials for Nessus
              • Exporting Nessus Scans
              • Scanning Issues
            • OpenVAS
              • Installing OpenVAS
              • OpenVAS Scan
              • Exporting Scans
            • Nexpose
            • Qualys
          • Security Assessments
          • Vulnerability Assessment
          • Assessment Standards
          • Common Vulnerability Scoring System (CVSS)
          • Common Vulnerabilities and Exposures (CVE)
            • Open Vulnerability Assessment Language (OVAL)
          • Reporting
        • 📂File Transfers
          • File Transfer Methods
            • Windows File Transfer Methods
              • ⬇️Download Operations
                • 🪟 PowerShell Base64 Encode & Decode
                • 🌐 PowerShell Web Downloads -
                • 📦 SMB Downloads
                • 🌐 FTP Downloads
              • ↗️Upload Operations
                • 🔐 Encode File Using PowerShell
                • 🌐 PowerShell Web Uploads
                • 🧬 PowerShell Base64 Web Upload
                • 🌐 SMB Uploads with WebDAV Twist
                • 📡 FTP Uploads
            • Linux File Transfer Methods
              • Download Operations
                • 📦 Base64 Encoding / Decoding for File Transfers
                • 🌐 Web Downloads with Wget and cURL
                • 💣 Fileless Attacks in Linux – Execute Directly
                • 🐚 Download with Bash using /dev/tcp
                • 🔐 SSH Downloads with scp
                  • More Usage on SCP
              • Upload Operations
                • 🌐 Web Upload with HTTPS 🚀
                • 🛠️ Quick Web File Transfer Method
                • 🔄 SCP Upload
            • Transferring Files with Code
              • Downloading Files
              • Uploading Files
            • Transfer Files with Netcat, Ncat, RDP
            • Powershell Session File Transfer
            • RDP File Transfer
            • Protected File Transfers
            • Sending Files over HTTP/S
            • Upload and Download with Built in OS Tools
          • Detect or Be Detected
            • Detection
            • Evade Detection
        • 🐚Shells & Payloads
          • The Shell Basics
            • Bind Shell
            • Reverse Shell
          • Creating Payloads
            • Introduction to Payloads
            • Metasploit Payloads
            • Crafting Payloads with MSFvenom
          • Infiltrating Windows
            • 🛠️ MS17-010 EternalBlue
          • Infiltrating Unix/Linux
            • 🐍 Spawning a TTY Shell with Python
            • Spawing Interactive Shells
          • Web Shells
            • 🧪 Laudanum – "One Web Shell to Rule Them All"
            • 🧠 Antak Webshell + ASPX Concepts
            • 🐘 PHP Web Shells
            • Shells & Payloads - The Live Engagement
          • Detection and Prevention
        • 👾Metasploit
          • Introduction
            • 🧰 Introduction to Metasploit Framework (MSF)
            • MSF Engagement Structure
          • MSF Components
            • 🧰 Modules
            • 🎯 Targets
            • 🧠 Payloads
            • 🔧 Encoders?
            • 🗄️ Database
            • 🔌 Plugins
          • MSF Sessions
            • 🔁 Sessions
            • 🛠️ Meterpreter
          • Additional Features
            • 🛠️ Installing & Importing Custom Metasploit Modules
            • 🧠 Porting Scripts into Metasploit Modules
            • 💥 Introduction to MSFVenom
            • 🛡️ Firewall and IDS/IPS Evasion
        • ⚔️Password Attacks
          • Where Credentials are Stored?
          • John The Ripper
          • Remote Password Attacks
            • 🖥️ Network Services
              • WinRM [5985, 5986]
              • SSH [22]
              • RDP [3389]
              • SMB [139,445]
              • Questions
            • 🔐 Password Mutations & Wordlist Generation
            • 🔐 Password Reuse & Default Passwords
          • Windows Local Password Attacks
            • Attacking SAM (Security Account Manager)
            • Attacking LSASS
      • TCM Security - PNPT
      • Cisco Ethical Hacker
      • Introduction to Hacking Methodology
    • Pentesting Services
    • Pentesting Web
      • CBBH
      • TCM Security - Practical Web Hacking
    • Pentesting Wi-Fi
      • OSWP
      • Wireless Penetration Test (WPA2)
    • Pentesting Cloud
    • Network Defense
      • Blue Team Level 1
    • 🐍Scripting with Python
    • ☢️Active Directory Penetration Testing
      • Initial Attack Vectors
      • Post Compromise Enumeration
    • Cybersecurity Job Skills
      • Information Security Officer Guide
    • 🔍IP Address Investigation
      • WHOIS
      • Reverse DNS
      • Geolocation of the IP
      • Check If IP is Active and has Services Running
      • Check the IP Reputation
      • Check Passive DNS History
      • Confirm the Actual Server Location
    • Cybersecurity Projects
      • Wireless Penetration Test (WPA2)
      • AWS Honeypot
      • SOC Analyst Home Lab
      • Threat Management with Wazuh SIEM
    • Cybersecurity Books
    • 🔄SOC
  • IT Certifications & Notes
    • Certifications
      • MS-900 Microsoft 365 Fundamentals
        • Describe Microsoft security and compliance capabilities
          • Describe the functions and identity types of Microsoft Entra ID
          • Describe access management capabilities of Microsoft Entra
            • Introduction
            • Describe Conditional Access
            • Describe Global Secure Access in Microsoft Entra
            • Describe Microsoft Entra roles and role-based access control (RBAC)
      • CISSP
      • ITIL
        • ITIL 4 Foundations
      • CCNA
        • David Bombal - Udemy
        • CCNA Training - Jeremy's IT Lab
          • Resources
          • Cisco Packet Tracer Labs
            • Cisco Packet Tracer Overview
            • Packet Tracer Lab 1
      • MCSE Certification Options
      • AZ-900
    • IT Projects & Training
      • Windows Server 2016 - Active Directory Lab Build
      • Windows Server 2022 Fundamentals
        • Introduction to Server Manager
          • Installing and Configuring Server Manager
          • Creating a VM on Microsoft Azure for Server 2022
        • Introduction to Active Directory
          • Active Directory and Setting up
          • Active Directory Overview
          • Delegation Rights for Active Directory
          • Active Directory Administrative Center
          • Common cmd commands for IT Support
        • Group Policy Management
          • How to apply basic GPO
        • Introduction to Share Folders
          • Creating Share Folders on Server Manager
          • Share Folder Permissions for Users
          • Map a Network Drive (locally)
          • Map a Network Drive through Active Directory
        • Understanding Windows/Common AD Issues
          • Installing RSAT Tools
          • Joining a PC to the Domain
        • Real Life IT Support Issues
          • When a User Gets locked out their accounts
          • Change Password of a User
      • Office 365 For IT Support
        • Office 365 Overview
      • Microsoft Azure Training
        • Getting Started in the Azure Portal
        • Introduction to Microsoft Azure Services
        • Basic Usage of Azure Services
        • Azure Deploy Sql Database Overview
        • Azure AD Connect Overview
        • Azure Microsoft File Share/Map Drives
        • Deploy Windows 11 to Azure
        • Microsoft Azure Basic Fundamentals (Azure Active Directory)
        • Introduction to Vnet (Overview)
        • Microsoft Azure Network/Security
        • Microsoft Azure Tagging (Final Course)
      • Networking Projects with Cisco Packet Tracer
        • Build a Basic Network
        • Webserver Project
      • Setup and Router and Switch
    • IT Knowledge Base
  • CTF/Box WRITEUPS
    • Tryhackme
    • HTB
      • Footprinting Lab - Easy
      • Footprinting Lab - Medium
      • Footprinting Lab - Hard
      • Nessus Skills Assessment
      • OpenVAS Skills Assessment
      • Tier 0
      • Tier 1
  • Cryptocurrency/Blockchain
    • Cryptocurrency Investigation
    • Certifications
      • Certified Blockchain Security Professional
Powered by GitBook
On this page
  1. Cybersecurity Certifications & Notes
  2. Certifications & Courses
  3. Hackthebox - CPTS
  4. Footprinting
  5. Host-Based Service Enumeration
  6. DNS [53]
  7. Basics

Default Configuration

PreviousDNS RecordsNextDangerous Settings

Last updated 3 months ago

There are many different configuration types for DNS. Therefore, we will only discuss the most important ones to illustrate better the functional principle from an administrative point of view. All DNS servers work with three different types of configuration files:

  1. local DNS configuration files

  2. zone files

  3. reverse name resolution files

The DNS server is very often used on Linux-based distributions. Its local configuration file (named.conf) is roughly divided into two sections, firstly the options section for general settings and secondly the zone entries for the individual domains. The local configuration files are usually:

  • named.conf.local

  • named.conf.options

  • named.conf.log

It contains the associated RFC where we can customize the server to our needs and our domain structure with the individual zones for different domains. The configuration file named.conf is divided into several options that control the behavior of the name server. A distinction is made between global options and zone options.

Global options are general and affect all zones. A zone option only affects the zone to which it is assigned. Options not listed in named.conf have default values. If an option is both global and zone-specific, then the zone option takes precedence.

Local DNS Configuration

DNS

root@bind9:~# cat /etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "domain.com" {
    type master;
    file "/etc/bind/db.domain.com";
    allow-update { key rndc-key; };
};

A zone file is a text file that describes a DNS zone with the BIND file format. In other words it is a point of delegation in the DNS tree. The BIND file format is the industry-preferred zone file format and is now well established in DNS server software. A zone file describes a zone completely. There must be precisely one SOA record and at least one NS record. The SOA resource record is usually located at the beginning of a zone file. The main goal of these global rules is to improve the readability of zone files. A syntax error usually results in the entire zone file being considered unusable. The name server behaves similarly as if this zone did not exist. It responds to DNS queries with a SERVFAIL error message.

In short, here, all forward records are entered according to the BIND format. This allows the DNS server to identify which domain, hostname, and role the IP addresses belong to. In simple terms, this is the phone book where the DNS server looks up the addresses for the domains it is searching for.

Zone Files

DNS

root@bind9:~# cat /etc/bind/db.domain.com

;
; BIND reverse data file for local loopback interface
;
$ORIGIN domain.com
$TTL 86400
@     IN     SOA    dns1.domain.com.     hostmaster.domain.com. (
                    2001062501 ; serial
                    21600      ; refresh after 6 hours
                    3600       ; retry after 1 hour
                    604800     ; expire after 1 week
                    86400 )    ; minimum TTL of 1 day

      IN     NS     ns1.domain.com.
      IN     NS     ns2.domain.com.

      IN     MX     10     mx.domain.com.
      IN     MX     20     mx2.domain.com.

             IN     A       10.129.14.5

server1      IN     A       10.129.14.5
server2      IN     A       10.129.14.7
ns1          IN     A       10.129.14.2
ns2          IN     A       10.129.14.3

ftp          IN     CNAME   server1
mx           IN     CNAME   server1
mx2          IN     CNAME   server2
www          IN     CNAME   server2

For the IP address to be resolved from the Fully Qualified Domain Name (FQDN), the DNS server must have a reverse lookup file. In this file, the computer name (FQDN) is assigned to the last octet of an IP address, which corresponds to the respective host, using a PTR record. The PTR records are responsible for the reverse translation of IP addresses into names, as we have already seen in the above table.

Reverse Name Resolution Zone Files

DNS

root@bind9:~# cat /etc/bind/db.10.129.14

;
; BIND reverse data file for local loopback interface
;
$ORIGIN 14.129.10.in-addr.arpa
$TTL 86400
@     IN     SOA    dns1.domain.com.     hostmaster.domain.com. (
                    2001062501 ; serial
                    21600      ; refresh after 6 hours
                    3600       ; retry after 1 hour
                    604800     ; expire after 1 week
                    86400 )    ; minimum TTL of 1 day

      IN     NS     ns1.domain.com.
      IN     NS     ns2.domain.com.

5    IN     PTR    server1.domain.com.
7    IN     MX     mx.domain.com.
...SNIP...

In this file, we can define the different zones. These zones are divided into individual files, which in most cases are mainly intended for one domain only. Exceptions are ISP and public DNS servers. In addition, many different options extend or reduce the functionality. We can look these up on the of Bind9.

📜
🟢
👣
🔎
Bind9
documentation