Attacking DNS

DNS is mostly UDP/53, but DNS will rely on TCP/53 more heavily as time progresses

Enumeration

nmap -p53 -Pn -sV -sC 10.10.110.213

DNS Zone Transfer

DIG - AXFR Zone Transfer

dig AXFR @ns1.inlanefreight.htb inlanefreight.htb

Tools like Fierce can also be used to enumerate all DNS servers of the root domain and scan for a DNS zone transfer:

fierce --domain zonetransfer.me

Domain Takeovers & Subdomain Enumeration

Domain takeover is registering a non-existent domain name to gain control over another domain. If attackers find an expired domain, they can claim that domain to perform further attacks such as hosting malicious content on a website or sending a phishing email leveraging the claimed domain.

Domain takeover is also possible with subdomains called subdomain takeover

A DNS’s canonical name (CNAME) record is used to map different domains to a parent domain

 A DNS’s canonical name (CNAME) record is used to map different domains to a parent domain. Many organizations use third-party services like AWS, GitHub, Akamai, Fastly, and other content delivery networks (CDNs) to host their content. In this case, they usually create a subdomain and make it point to those services. For example,

sub.target.com.   60   IN   CNAME   anotherdomain.com

The domain name (e.g., sub.target.com) uses a CNAME record to another domain (e.g., anotherdomain.com). Suppose the anotherdomain.com expires and is available for anyone to claim the domain since the target.com’s DNS server has the CNAME record. In that case, anyone who registers anotherdomain.com will have complete control over sub.target.com until the DNS record is updated.

Subdomain Enumeration

Before performing a subdomain takeover, we should enumerate subdomains for a target domain using tools like Subfinder. This tool can scrape subdomains from open sources like DNSdumpster. Other tools like Sublist3r can also be used to brute-force subdomains by supplying a pre-generated wordlist:

./subfinder -d inlanefreight.com -v       

An excellent alternative is a tool called Subbrute. This tool allows us to use self-defined resolvers and perform pure DNS brute-forcing attacks during internal penetration tests on hosts that do not have Internet access.

git clone https://github.com/TheRook/subbrute.git >> /dev/null 2>&1

cd subbrute

 echo "ns1.inlanefreight.com" > ./resolvers.txt

./subbrute inlanefreight.com -s ./names.txt -r ./resolvers.txt

host support.inlanefreight.com

 
support.inlanefreight.com is an alias for inlanefreight.s3.amazonaws.com

The support subdomain has an alias record pointing to an AWS S3 bucket. However, the URL https://support.inlanefreight.com shows a NoSuchBucket error indicating that the subdomain is potentially vulnerable to a subdomain takeover. Now, we can take over the subdomain by creating an AWS S3 bucket with the same subdomain name.

The can-i-take-over-xyz repository is also an excellent reference for a subdomain takeover vulnerability. It shows whether the target services are vulnerable to a subdomain takeover and provides guidelines on assessing the vulnerability.

DNS Spoofing

Local DNS Cache Poisoning

To exploit the DNS cache poisoning via Ettercap, we should first edit the /etc/ettercap/etter.dns file to map the target domain name (e.g., inlanefreight.com) that they want to spoof and the attacker’s IP address (e.g., 192.168.225.110) that they want to redirect a user to:

cat /etc/ettercap/etter.dns
 
inlanefreight.com      A   192.168.225.110
*.inlanefreight.com    A   192.168.225.110

Next, start the Ettercap tool and scan for live hosts within the network by navigating to Hosts > Scan for Hosts. Once completed, add the target IP address (e.g., 192.168.152.129) to Target1 and add a default gateway IP (e.g., 192.168.152.2) to Target2.

Activate dns_spoof attack by navigating to Plugins > Manage Plugins. This sends the target machine with fake DNS responses that will resolve inlanefreight.com to IP address 192.168.225.110: After a successful DNS spoof attack, if a victim user coming from the target machine 192.168.152.129 visits the inlanefreight.com domain on a web browser, they will be redirected to a Fake page that is hosted on IP address 192.168.225.110: