dnsenum – Backtrack 5 – Information Gathering – Network Analysis – DNS Analysis – dnsenum

The dnsenum.pl Perl script as described in its Perl documentation is a multithreaded script to enumerate information on a domain and to discover non-contiguous IP blocks. So the gist of dnsenum is to gather information about a specific domain using various sources. Information gathered about a domain includes sub domains, associated IP ranges, name servers, mx records, reverse DNS records, hostname IP addresses, and potential vulnerabilities via zone transfers. Below we go into detail regarding the switches available with dnsenum as well as what the command returns by default without and CLI switches.

dnsenum – DNS & IP Block Enumeration On Backtrack Linux

Click on the dnsenum Perl Documentation link below to expand out the dnsenum docs.

dnsenum Perl Script: Default Output Against cnn.com

I think the output of dnsenum is pretty slick! You can quickly grab a bunch of info about a specific domain that provide a great starting point to begin for information gathering. It will be highly unlikely that you will have any success with AXFR record queries or zone transfers but it definitely doesn’t hurt anything to attempt these unless you are trying to be stealth. If you do come across a successful AXFR record query it will be a major finding as you could potentially obtain details about a domain that should not be public. With a successful zone transfer you will also potentially gain access to every DNS record associated to the domain.

Notice how in the documentation there are nine items that dnsenum notes it will provide. Unfortunately this is not entirely true on Backtrack Linux 5 as a couple of the outputs seems to be not working correctly. I hope to look at this in more detail in the future but for now we will note each of the nine items and provide examples where possible. I have cut only the output pertaining to the piece of data noted so for example when the default command is used by only specifying a domain and without any switches there is still a bunch of information output to the screen.

dnsenum Functionality And Output On Backtrack Linux 5 R3:

Output Data: Output Hostname – ONE

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl example.com

Hostname Example Output:

Output Data: Output Name Servers – TWO

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl example.com

Name Servers Example Output:

Output Data: Output MX Records – THREE

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl SomeDomain.com

MX Records Example Output:

Output Data: Zone/AXFR Queries To Name Servers – FOUR

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl SomeDomain.com

Zone Transfer/AFXR Query Example Output:

Output Data: Scrape Sub Domains From Google – FIVE

Status: Not Functional

Command Example/Necessary Switches: perl dnsenum.pl -s 5 -p 5 SomeDomain.com

Google Sub Domain Scrape Example Output:

Notes: Since this is not functional you can manually run the command in a Google search: “allinurl: -www site:DOMAIN-NAME-HERE”

Output Data: Bruteforce Sub Domains From File – SIX

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl -f somefile.txt –dnsserver 8.8.8.8 example.com

Bruteforced Sub Domains Example Output:

Notes: We are using the Google public DNS server of 8.8.8.8 however you can replace this with any DNS server that you like. It may be beneficial to use the companies DNS server or a DNS server you have setup a specific way.

Output Data: Calculate Network Blocks – SEVEN

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl -f somefile.txt –dnsserver 8.8.8.8 example.com

Network Blocks Example Output:

Notes: In the example we show RFC 1918 IP space or private IP’s however in real output you would only see public IP ranges unless you specified the –private switch and then the private networks would display at the bottom of the output file.

Output Data: Perform Reverse Lookups On IP Ranges – EIGHT

Status: Not Functional

Command Example/Necessary Switches: Default Command, No Switches Required

IP Range Reverse Lookup Results Example Output:

Notes: If you want to run reverse lookups manually against the subnets you could use something like the following command.The below command was modified from a broken command found here. It is not perfect but provides a quick and dirty way to run reverse lookups on large IP subnets quickly.

Output Data: Output Non-Contiguous IP-Blocks Results To File – NINE

Status: Functional

Command Example/Necessary Switches: perl dnsenum.pl -f dns.txt –dnsserver 8.8.8.8 –noreverse cnn.com

Non-Contiguous IP-Block Example Output:

Notes: Notice most of the above IP’s are not really subnets at all however I cut the results short to save output in the article. You will definitely run across larger networks when using dnsenum.

Out of all nine of the functions dnsenum describes in its man page there are only two that are not functional at this time. It appears that dnsenum has help up fairly well over time which is impressive considering it hasn’t been updated in so long. One more switch that appears to not be functional at all times but does work some of the time is the –subfile switch which writes located sub domains to a file by the name specified after the –subfile switch. I believe it either has something to do with the number od sub domains located or with the switch combinations used so you might try a couple different switch combinations if you need the –subfile switch functionality. Below we show our final example which combines a ton of the above examples into one large domain recon command that could be useful when information gathering on a specific domain!

dnsenum – Multi Switch Use Example On Backtrack Linux:

There you have it… dnsenum examples and information regarding its current status in Backtrack Linux version 5 release 3. If anyone has any additions in terms of functionality either email me or note in the comments below!

Click here for more Backtrack Linux articles.