DNS Enumeration

  1. gem install net-dns

In ruby script

  1. require 'net/dns'

Forward DNS lookup

The main usage is

  1. require 'net/dns'
  2. resolver = Net::DNS::Resolver.start("google.com")

Returns

  1. ;; Answer received from 127.0.1.1:53 (260 bytes)
  2. ;;
  3. ;; HEADER SECTION
  4. ;; id = 36568
  5. ;; qr = 1       opCode: QUERY   aa = 0  tc = 0  rd = 1
  6. ;; ra = 1       ad = 0  cd = 0  rcode = NoError
  7. ;; qdCount = 1  anCount = 6     nsCount = 4     arCount = 4
  9. ;; QUESTION SECTION (1 record):
  10. ;; google.com.                  IN      A
  12. ;; ANSWER SECTION (6 records):
  13. google.com.             31      IN      A       64.233.183.102
  14. google.com.             31      IN      A       64.233.183.113
  15. google.com.             31      IN      A       64.233.183.100
  16. google.com.             31      IN      A       64.233.183.139
  17. google.com.             31      IN      A       64.233.183.101
  18. google.com.             31      IN      A       64.233.183.138
  20. ;; AUTHORITY SECTION (4 records):
  21. google.com.             152198  IN      NS      ns1.google.com.
  22. google.com.             152198  IN      NS      ns3.google.com.
  23. google.com.             152198  IN      NS      ns4.google.com.
  24. google.com.             152198  IN      NS      ns2.google.com.
  26. ;; ADDITIONAL SECTION (4 records):
  27. ns3.google.com.         152198  IN      A       216.239.36.10
  28. ns4.google.com.         152198  IN      A       216.239.38.10
  29. ns2.google.com.         152198  IN      A       216.239.34.10
  30. ns1.google.com.         345090  IN      A       216.239.32.10

As you can see from response above, there are 5 sections

  • Header section: DNS lookup headers
  • Question section: DNS question,
  • Answer section: Array of the exact lookup answer (base on lookup type. ex. A, NS, MX , etc)
  • Authority section: Array of authority nameserver
  • Additional section: Array array of nameserver lookup

Since its all are objects, we can call each section like that

  1. resolver.header
  2. resolver.question
  3. resolver.answer
  4. resolver.authority
  5. resolver.additional

A record

Because the A record is the default, we can do like above example

  1. resolver = Net::DNS::Resolver.start("google.com")

or in one line to get exact answer.

  1. resolver = Net::DNS::Resolver.start("google.com").answer

will return an array with all IPs assigned to this domain

  1. [google.com.             34      IN      A       74.125.239.35,
  2.  google.com.             34      IN      A       74.125.239.39,
  3.  google.com.             34      IN      A       74.125.239.33,
  4.  google.com.             34      IN      A       74.125.239.34,
  5.  google.com.             34      IN      A       74.125.239.36,
  6.  google.com.             34      IN      A       74.125.239.32,
  7.  google.com.             34      IN      A       74.125.239.46,
  8.  google.com.             34      IN      A       74.125.239.40,
  9.  google.com.             34      IN      A       74.125.239.38,
  10.  google.com.             34      IN      A       74.125.239.37,
  11.  google.com.             34      IN      A       74.125.239.41]

MX lookup

  1. mx = Net::DNS::Resolver.start("google.com", Net::DNS::MX).answer

returns an array

  1. [google.com.             212     IN      MX      40 alt3.aspmx.l.google.com.,
  2.  google.com.             212     IN      MX      30 alt2.aspmx.l.google.com.,
  3.  google.com.             212     IN      MX      20 alt1.aspmx.l.google.com.,
  4.  google.com.             212     IN      MX      50 alt4.aspmx.l.google.com.,
  5.  google.com.             212     IN      MX      10 aspmx.l.google.com.]

All lookup

  1. any = Net::DNS::Resolver.start("facebook.com", Net::DNS::ANY).answer

returns

  1. [facebook.com.           385     IN      A       173.252.120.6,
  2.  facebook.com.           85364   IN      TXT     ,
  3.  facebook.com.           149133  IN      NS      b.ns.facebook.com.,
  4.  facebook.com.           149133  IN      NS      a.ns.facebook.com.]

for list of types, please refer to the gem docs

Reverse DNS lookup

  1. resolver = Net::DNS::Resolver.new
  2. query = resolver.query("69.171.239.12", Net::DNS::PTR)

If you want to specify the nameserver(s) to use, it support an array of nameserver

  1. resolver = Net::DNS::Resolver.new(:nameserver => "8.8.8.8")

or update the object

  1. resolver = Net::DNS::Resolver.new
  2. resolver.nameservers = ["8.8.4.4" , "8.8.8.8"]

http://searchsignals.com/tutorials/reverse-dns-lookup/