Wireshark 101: The Domain Name System; HakTip 129 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by
HipChat welcome active the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morrison today we are checking
out Wireshark and DNS woohoo
so first off DNS that means domain name
system it's the reason why you type in a
website like google.com and it goes to
Google coms IP address so mix it work
now this way you don't have to memorize
a whole bunch of different numbers to
take you wherever you want to go on the
entire interwebs so to view all the
different types of DNS traffic you might
run into go over to the site called I SC
org slash community slash rfcs slash of
D & S this is a very handy site to show
you all the different RFC's for all the
different DNS traffic that you might
find now whenever you look at a DNS
packet now this is the part where we're
gonna get into Wireshark you'll run into
a whole bunch of different information
so follow along with me as we get into
Wireshark yay fun times so first off we
have a DNS ID number and this is gonna
associate the queries with the responses
cuz again you're gonna have packets that
match up with each other yeah they're
like bouncing balls I guess super fun so
first off we have this one which is DNS
query from me and I'm looking for hak5
org so I type in hack v org into the
search bar as I usually would then down
here I see a transaction ID this is
ninety three twenty nine so I can go
down a little bit farther see another
query for ninety three twenty nine and
then we have a couple of responses with
the same transaction ID how very cool
now if you look at the packet header I'm
gonna go back up to the first one that I
had on here there we go and I have all
my Flags open cool you notice that this
runs off under UDP or user Datagram
protocol which we have explained prior
and it's domain name System DNS for
short now moving on you're going to see
it little thing in here called an opcode
this is going to let you know what kind
of query you're actually running on here
for me I'm just doing a standard query
you also have a Thorat ativ answers if
the response packet is from a name
server next underneath that is called TC
or truncated for short and this is going
to tell you if the packet that you're
sending is way too big of a big big
thing of data to actually fit in just
one packet underneath there is called
recursion desired or Rd for short this
means that the name of the server will
support recursive queries Z stands for
reserved and it'll tell you yes or no
whether it is reserved or it's not
usually it's just gonna be set to all
zeros and in my case it is set to all
zeros but this can also be used by the R
code field below it as an extension as
well if you do have the R code available
now response code shows you any kind of
different errors if you have response
codes available and then underneath that
you'll have a question count so question
count will show you the number of
entries in the questions section more on
that in a bit
now answer count is the same thing for
answers and the name server count shows
you the number of name server resource
records found in the authority section
if available as well now there's still a
little bit more available in here too so
I'll move on a little bit farther down
additional records counts shows you the
number of other resources resource
records in the additional info section
questions has queries that will be sent
to the DNS server answers will also
answer any queries authority is the
section that will have resource records
for authoritative nameservers used to
continue the resolution process and
lastly is the additional information
section which may or may not exist on
your specific packet query oh that's a
lot of different sections in one simple
packet header but there's a lot of
information going on whenever you're
sending out a DNS query now DNS is also
a question response format as I said
more on this later now similar to other
protocols of course you're going to have
matching packets the client asks for an
IP address from the DNS server and then
the server is going to send back
information as a response so they talk
back and forth in its simplest form DNS
only has two different packets you'll
see a few different resource record
types whenever you look at one of these
it's including a from ipv4 host address
NS for a name server txt for a text
string and so on and so forth more of
this information can be found over on
another handy website called
Ayana dot org this is a great website I
know I keep bringing it up but it's
awesome you can look under here and see
all the different class codes for all
the different DNS queries that you can
send so definitely check that out and do
a little bit more research over there
now I'm gonna explain a little bit more
about DNS right after the break but
we're gonna go thank our sponsor how is
your team communicating are they using a
variety of email I am texting cloud
storage and document sharing apps
HipChat puts everything in one place and
it's designed specifically for business
the solution HipChat is I am video chat
document sharing screen sharing system
updates and my favorite code sharing
integrated all into one simple platform
email is way too slow meetings get
sidetracked all the time and regular
AIIMS don't work well for groups HipChat
keeps your team in sync and it works
from any device no matter where you are
the best part HipChat integrates with
the top developer tools like github JIRA
Zendesk and more you can check out
fifty-seven services in all that HipChat
works and plays nice with HipChat brings
your entire project and your team
communications together if chat is easy
to set up it's fun to use and it makes
your team wildly productive I use
HipChat here in our offices specifically
to share code with Daren for my Arduino
builds on hack 5 you can get your team
on the same page in seconds I want you
to try HipChat free with no credit card
required visit HipChat comm slash hot
tip sign-up click on the start chatting
button and then invite a few team
members and try it for free for 30 days
remember that's HipChat comm / hack tip
and for the first 100 signups HipChat is
going to extend their 30-day free trial
to 90 days HipChat your team your
project in sync instantly
we're back now for some more info on
recursion which I mentioned earlier now
this happens when a DNS server acts like
a client to further on the packet in
order to find an IP address of an
outside site like when you visit Google
commerce or --g under the recursion
desired label it'll say do query
recursively and you'll see that in
Wireshark when it happens if the DNS
server doesn't know which IP address
belongs to a WW site or whatever its
visiting it'll continue on the packet to
another DNS server depending on where
the site server is located physically
and on the interwebs the query can
travel through many different DNS
servers until it actually finds the
correct IP and it sends it back to you
this might explain why some sites load
slower than others now lastly let's talk
a little bit about zones DNS hak5 for
example has a bunch of different DNS
servers for all of our different stuff
so like we have hacked five org on a DNS
server and then we have our email on a
different DNS server and we might have
hack shop on a DNS server in a copy of
hack five org and so on and so far these
servers are all called zones and they
are the authorities for the subdomains a
zone transfer might occur if a company
like hack 5 or any other company wants
to keep the domain redundant on another
server so there can be a full zone
transport or a incremental zone transfer
either meaning the entire zone is
transferred or just a part of it zone
transfers run on TCP over UDP with DNS
because of the size of the packet that's
a lot of data moving back and forth so
they need it to be reliable
luckily TCP ends up being more reliable
so it uses TCP now in Wireshark this
would be seen under the type so usually
under type you'll see something
different but in this case you would
either see a FXR for a full zone
transfer now let me know what you think
of all this crazy information about DNS
I know it's a little bit more
complicated begin this is an upper layer
protocol now send me a comment below or
email us tips at hack 5 org and be sure
to check out our sister show hack 5 for
more great stuff just like this I'll be
there reminding you to
trust your Technol us a