[Tut] DNS Hacking and Information gathering - Windows [Local Injection]

Code:

When NSLOOKUP starts, before anything else, it checks the computer's network configuration to determine the IP address of the DNS server that the computer uses.

Then it does a reverse DNS lookup on that IP address to determine the name of the DNS server.



If reverse DNS for that IP address is not setup correctly, then NSLOOKUP cannot determine the name associated with the IP address.

On Windows Vista/2008, it then says "Default Server: UnKnown".

On earlier Windows versions, it displays the error message "*** Can't find server name for address ...".



This does NOT indicate a problem with the actual domain name that you are trying to look up.

It only means that there is no reverse DNS name for the DNS server IP address, which in most cases may not be a problem at all.

Code:

HINFO   -      Host Information

MX      -      Mail Exchange Record

TXT     -      Text String

A         -       IPv4 Address (32 bits)

NS       -       Name Server

CNAME  -       Canonical Name

PTR      -      Pointer Record

AAAA    -      IPv6 Address (128 bits)

AXFR    -     Request for Zone Transfer

ANY     255     Request for All Records

Code:

Command Mode options:



 help or ?          - print a list of Command Mode options

 exit or ^C         - exit "command mode" 



 set all            - print options, current server and host

 finger [USER]      - finger the optional NAME at the current default host

 MyHost             - print ip address of MyHost

 MyHost MyNameServer - print ip address of MyHost on MyNameServer

 set [no]debug      - print debugging info

 set [no]d2         - print exhaustive debugging info



 set domain=NAME    - set default domain name to NAME

 set root=NAME      - set root server to NAME

 root               - set current default server to the root

 server NAME        - set default server to NAME, using current default server

 lserver NAME       - set default server to NAME, using initial server

 set srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1, N2,...



 set retry=X        - set number of retries to X

 set timeout=X      - set initial time-out interval to X seconds

 set [no]defname    - append domain name to each query

 set [no]recurse    - ask for recursive answer to query

 set [no]search     - use domain search list

 set [no]vc         - always use a virtual circuit

 set class=X        - set query class (for example, IN (Internet), ANY)

 set [no]msxfr      - use MS fast zone transfer

 set ixfrver=X      - current version to use in IXFR transfer request

 set type=X         - set query type 

 set querytype=X    - set query type

                      (e.g. A, ANY, CNAME, MX, NS, PTR, SOA, SRV)



 ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN

                            (and optionally output to FILE)



    -d          -  list all records

    -t TYPE     -  list records of the given Type (for example, A, CNAME, 

                   MX, NS, PTR, and so on)

    -a          -  list Aliases and canonical names.



 view FILE       - sort an 'ls' output file and view it with pg



Example:



C:\> nslookup -querytype=TXT -timeout=10 porttest.dns-oarc.net

Code:

set q=any 

google.com  <-- (its your box)

Code:

The DNS system and the whois system are not the same, they are only loosely tied together.

If the whois system is broken, (while the DNS system is working) the whole Internet will work fine.

If the DNS system is broken (while the whois system is working), the whole Internet will die.



The whois system is supposed to display who owns the domain and their corresponding name servers,

however, due to usually defective software at whois servers at domain registrars,

(the amount of defects is proportional to the registrar's domain registration fees),

the DNS name servers information obtained from the whois query is often wrong, out of date, and inaccurate.