Tufan Turhan
  • Introduction
  • Red Teaming
    • Initial Access
      • VoipHopper
      • SMB – SCF File Attacks
      • MITM6
      • LLMNR, NBT-NS, mDNS Zehirlemeleri ve Relay Ataklar
    • Responder - DNS Injection
    • Privilege Escalation
      • PrintNightmare
      • Juicy Potato ile Windows Yetki Yükseltme
      • Token Impersonation with Incognito
    • Active Directory & Kerberos
      • Kerberos
      • Kerberosting
      • AS-REP Roasting
      • Overpass The Hash/Pass The Key (PTK)
      • DCSync Attack
      • DCShadow Attack
      • GETTGT
      • Golden Tickets
      • Silver Tickets
      • PowerView
      • MS14-025 (GPP Abusing)
      • BloodHound
      • Procdump
    • Lateral Movement
      • RDP MiTM-Hijacking
      • Vlan Hopping
      • Pivoting
    • Network Pentest
      • IPv4 Subnet Cheat Sheet
      • DNS Spoofing
      • DHCP Rogue
    • Shell to Meterpreter
    • Turn Off or Bypass AV
    • Useful CMD or Powershell Command
    • Brute Force
    • Windows Dosya İndirme
    • Windows UAC Bypass
    • Insecure Dosya İzni
  • Pentesting
    • Pentesting FTP - 21
    • Pentesting SMTP - 25,465,587
    • Pentesting SMB - 139 & 445
    • Pentesting Telnet - 23
    • Pentesting DNS - 53
    • Pentesting MSRPC -135
    • Pentesting SNMP - 161,162
    • Pentesting LDAP - 389,636
    • Pentesting MSSQL - 1433
    • Pentesting MYSQL - 3306
    • Pentesting RDP - 3389
    • Pentesing WINRM 5985,5986
  • Web Application
    • 2FA/OTP Bypass
    • Captcha Bypass
    • Cache Poisoning
    • Command Injection (OS)
    • CRLF Injection
    • Cross-site WebSocket hijacking (CSWSH) -
    • Cross-site request forgery (CSRF) -
    • Dangling Markup -
    • Path traversal
    • File Upload
    • Formula Injection (CSV Injection)
    • Login Bypass List
    • OAuth -
    • Open Redirect
    • Race Condition -
    • Registration - Password Reset & Takeover Vulnerabilities
    • SQL Injection
    • SSRF
  • Linux Privilege Escalation
    • PHP Wrapper
    • Simple Http
    • Editing /etc/passwd
    • SUID Binaries
    • Sudo Rights
    • Otomatize Araçlar
    • OSCP Not
  • HTB
  • Reverse Shell w/Msfvenom
  • Upgrading Simple Shells to Fully Interactive TTYs
Powered by GitBook
On this page
  • Zone Transfer -1-
  • Zone Transfer Otomatize Tool
  • Zone Transfer -2-
  • Nmap zone transfer
  • Nmap script
  1. Pentesting

Pentesting DNS - 53

PreviousPentesting Telnet - 23NextPentesting MSRPC -135

Last updated 2 years ago

Zone Transfer -1-

nslookup -query=ns megacorpone.com

yada

host -t ns megacorpone.com | cut -d " " -f 4

Komutunu yazarak ns'leri buluyoruz. Ardından aşağıda ki komutu yazarak tüm ns'lere zone transfer deniyoruz.

host -l megacorpone.com ns2.megacorpone.com

Zone Transfer Otomatize Tool

dnsrecon -d megacorpone.com -t axfr

Zone Transfer -2-

dig ns domainadi.com

answer sectionda verilen nsları şu şekilde tek tek deneyeceğiz.

 dig @ns1.example.com domainadi.com axfr

Transfer Failed dediği zaman başarısız olmuş yani zafiyet olmamış oluyor.

dig AXFR <domain_adresi> @10.10.10.10  #Domain ile birlikte deneme
dig axfr @<DNS_IP> #Domainsiz deneme
dnsrecon -t axfr -d <domain_adresi>
fierce --domain <domain_adresi> --dns-servers <DNS_IP>

Nmap zone transfer

nmap <IP> --script=dns-zone-transfer -p 53

Nmap script

nmap -n --script "(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport" <IP>