Carlos Perez
About Me
Director of Reverse Engineering for security vendor. Podcaster with PaulDotCom Contributor to Metasploit Blog: http://www.darkoperator.com/ Twitter: @Carlos_Perez
Disclaimer
The research and slides shown is my own and do not in any way are related or of knowledge of my current employer. All expressions and comments are my own.
What is Recon
It is a systematic and methodical approach for gathering information about a target. The information will provide a view in to the technologies and security posture of the target. The process must be one of little impact and draw as little attention to the task as possible.
Why DNS
The reliance of DNS in the enterprise has grown at the same rate as the complexity and distribution of the technologies has grown. VOIP Instant Messaging Email Management
Why DNS
Most organizations do not monitor DNS server trafc and logs. Those that do monitor generally only do do Zone Transfer attempts in their IPS/IDS Systems. Can provide information on security posture of the target.
Caveats of DNS
DNS is UDP so it is sensitive to the health of the connection path from the attacker to the target. DNS tends to have fake entries, stale entries, incorrect entries and entries to hosts that can not be reached. Location, location, location! what server we query will dictate what records we get.
DNSRecon
Included in BackTrack Linux 5, tested on OSX, Linux and Windows. Written in Python and tested on Python 2.6, 2.7 and 3.2 (Original was written in ruby 2 years ago) Can save results in XML, CSV or SQLite3. Includes Metasploit Plugin for importing XML and CSV results Includes Parser tool for XML and CSV results
Goals
Provide most of the known DNS enumeration techniques under one tool and that it. What techniques are executed and automation must be controlled by the user for best precision. Output must be easy to parse and easy to consume via command line or other tools.
Types of Enumeration
Standard Record Enumeration (Wildcard, DNSSEC, NS, SOA, MX, A, AAA, TXT, SPF and SRV) Zone Transfer Reverse Lookup Domain and Host Brute-force Cache Snooping Zone Walking (DNSSEC) Google Lookup
Standard Enumeration
What it does Checks for Wildcard Resolving Check if it responds to DNSSEC and type of proof of non-existence record used. Resolves SOA, NS, MX, A, AAAA, TXT and SPF. Enumerate known SRV Records Types
Standard Enumeration
Presence of DKIM (DomainKeys Identied Mail) and SPF (Sender Policy Framework) will reveal that email security technologies are in use. SPF will reveal what servers can send email. SRV (Service Records) Provide information on service, transport, port and order of importance for services and type of software can be deduced.
Standard Enumeration
Presence of records not having A, AAAA or CNAME records associated may show lack of maintenance or internal record names being leaked (no_ip).
Standard Enumeration
To run standard enumeration: ./dnsrecon.py -d <domain> ./dnsrecon.py -d <domain> -t std The -a option can be given to perform a AXFR against all NS records with port 53 TCP open The -s option can be given to perform a Reverse Lookup against all ranges in the SPF (Sender Policy Framework) record
Tuesday, November 20, 12
Standard Enumeration
Zone Transfer
It is still found in engagements to this day. Selects the Domain SOA and then queries for all of the NS records. Tests each NS record to see if port TCP 53 is open and if it is it tries a AXFR for the zone against the Name Server. Records returned are parsed and formatted. Made optional since it is easily picked up in Logs and IDS/IPS Systems
Zone Transfer
Even when a zone transfer is successful other NS servers should be queried for standard records compared to rule out: Name Server may be a test server. Name Server may contain stale data. Name Server may be a decoy.
Zone Transfer
To run AXFR enumeration: ./dnsrecon.py -d <domain> -a ./dnsrecon.py -d <domain> -t axfr More than one type can be specied ./dnsrecon.py -d <domain> -t std,axfr
Reverse Lookup
Performs a lookup for PTR (Pointer) Records against a given IPv4 or IPv6 range. Can be performed against all ranges in SPF Records. Can be performed against ranges found via Whois Queries against all A and PTR Records found.
Reverse Lookup
To run reverse lookup enumeration: ./dnsrecon.py -r <CDIR> ./dnsrecon.py -r <StartIP-EndIP> Expand SPF Record Ranges ./dnsrecon.py -d <domain> -s Perform Whois Queries against all IPs found ./dnsrecon.py -d <domain> -w
Reverse Lookup
Domain Brute-force
Append to the domain each entry given in a dictionary and tries to resolve A, AAA and CNAME Record Will perform a test to see if Wildcard resolution is enabled for the domain. To run Domain Name Brute-force:
./dnsrecon.py -d <domain> -D <NameList> -t brt
Domain Brute-force
Cache Snooping
Given a list of domain names it will check a specic Name Server for the presence of the record in its cache. Great for determining relations and outside services used that can be leveraged in Phishing attempts To perform the Cache Enumeration ./dnsrecon.py -t snoop -n Sever -D <Dict>
Cache Snooping
NSEC
Points to the next valid name in the zone le and is used to provide proof of non-existence of a name in the Zone
NSEC3
Replaced NSEC, points to the hashed value of next valid name in the zone le and is used to provide proof of non-existence of a name in the Zone
Zone Walk
SRV RR Leakage
SRV RR Leakage
SRV RR Leakage
RR Leakage
PTR RR Leakage
A RR Leakage
Parsing Data
Usage: parser.py <options> Options: -h, --help Show this help message and exit -f, --le <le> DNSRecon XML or CSV output le to parse. -l, --list Output an unique IP List that can be used with other tools. -i, --ips <ranges> IP Ranges in a comma separated list each in formats (rst-last) or in (range/bitmask) for ranges to be included from output. For A, AAAA, NS, MX, SOA, SRV and PTR Records. -t, --type <type> Resource Record Types as a regular expression to lter output. For A, AAAA, NS, MX, SOA, TXT, SPF, SRV and PTR Records. -s, --str <regex> Regular expression between quotes for ltering host names on. For A, AAAA, NS, MX, SOA, SRV and PTR Records. -n, --name Return list of unique host names. For A, AAAA, NS, MX, SOA, SRV and PTR Records.
Parsing Data
Parsing Data
Each command takes the -f option for loading the le generated by DNS Recon
Questions?