Lesson 33 : DNSmapping Video Lecture | Ethical Hacking using Kali Linux (in English) - Software Development

hey guys welcome to the next tutorial
for ethical hacking and penetration to
string we're kali linux so in this to
telling you more about mapping it works
and gathering more information about
them so the best tool that we would be
using as of now till now we have used a
lot of different tools but now I would
be using something different and it
would be the DNS map so if you have gone
through all my previous tutorials then
it would be quite easy for you to
understand what this does exactly else
else you won't be able to
so what DNS map tool does is that it
obtains all a records a records by a
records I mean IP addresses that are
associated to each successfully
brute-force sub domain and rather than
just one IP address per sub domain it
will gather all IP addresses through
brute force techniques after that it can
go to abort the brute forcing process in
the case the target domain uses
wildcards and ability it has the ability
to be able to run the tool without
providing a word list by using a
built-in list of keywords so I don't
need to actually provide and provide
different tools for them friend file
lists for them to Gordon brute force it
has its own inbuilt in the word supplied
and brute force can also be used by
using this user supplied word list if I
have one I can also go ahead and save
the results in a human readable and CSV
format for easy processing it has
improved building subdomains word lists
and it has even new a bash script such
as a DNS map - bulk a period SH then it
is a Linux format it includes all of
those things which allows running DNS
map against a list of domains from a
user supplied file that is brute forcing
several domains in a bulk fashion
bypassing of signature based DNS map
protection by generating a proper
pseudo-random subdomain when checking
for wildcards and this is the unique
feature of DNS map so you might be
wondering why I only use DNS map two
rather than going out and downloading
some random other file the reason being
that DNS map is free it's it has it is
useful in finding interesting remote
access servers it is also useful in
finding bad
configured or unpatch servers finding
new domain names which will allow you to
map the non-obvious and hard-to-find
network blocks sometimes you can also
find that some brute force or some brute
forced subdomains resolve two internal
IP addresses that's RFC 1918 and this is
a great as sometimes they are really up
to date a records which means that it is
possible to enumerate internal servers
of the target organization from the
internet by only using the DNS resolving
and nothing else which is quite useful
there so that it will not even leave a
target that you have actually targeted
this company and if which is actually
opposite to what the zone transfers do
for instance a DNS mapping can also
discover embedded services configured
using DNS dynamic services so it has all
of these features in total so now I
would teach you how we can go ahead and
use this so again the same thing
applications Kali Linux
information-gathering DNS analysis and
we have DNS map over here so you can see
that I can supply my own word list if
you want or the regular list file that
it has already in build and delay in
milliseconds as to when it wants to
repeat the process and these are the IPS
to ignore these are the false positives
and the CSV Delphi which I don't know
what exactly it is so I'll show you how
we can go ahead and gather information
first thing that you need to do is you
need to go ahead and select a target you
can go ahead and move to your pen test
directory so I'll just take CD slash pen
test if I have it okay I do not have the
pen destructor your mind I will just
start it in a random way so what I will
do is have this tile let us say DNS map
google.com let's check what we get 10
millisecond delay is there between
different requests so that Google does
not ban us out okay perfect
you have the IP address and ipv6 ipv4
and ipv6 address of the admin the
accounts for google.com we have that as
well
let's check out more we get a period of
calm good I believe it has lots of ipv4
a P dot google.com IP addresses this is
one way of using DNS mapping using a ten
milliseconds delay if I do not use a
delay I will get something else okay we
have received the billing information so
as you can see that all of these above
are the DNS map has scan are all these
subdomains of the Google along with the
air records that is IP address of Google
subdomains now these IP addresses or
ipv6 addresses are the simplest way of
using DNS map in order to perform a more
deep search there are several advanced
options that we can use in DNS to salsa
scored and quit this right now and I'll
show you how we can go and use this I
can use it - W to use the word list or I
can use the - R - go ahead and get the
regular the result list - that I
attached inbuilt the brute force files
CSV as I told you so examples for using
these options would be something like
that if you have a custom word list of
subdomains you can use that as well as
by simply specifying the hyphen W
argument and then the path to the word
list so here just type get nice map
google.com - W + x/y/z period lists
period t xt + - r / temp / domain VF
underscore results dot txt so what it
will do is that good and save all of
these files under the WTS T for XYZ P
dot txt file under the the temporary
directory of the domain bf underscore
results file and if you already have one
then you don't need to go ahead and
specify the W or the word list you can
just simply type DNS map will calm - our
/tmp / -
d300 would be 3,000 would be the
milliseconds that it would be using and
you can just go and hit enter and it
will simple straight away go ahead and
use the default file and say all of
these in the temp directory and that is
one more method of doing that while this
runs I'll go ahead and show that to you
using the built-in word list
as I believe - are is for the built-in
word list and now if you wanted to go
ahead and save these things let's try it
for something different let's type for
Microsoft com
so I'll type DNS map or com - our period
slash sub domain brute force underscore
results period txt now hit enter so what
did we do is it would go down create
this directory and say everything inside
the somme a subdomain brute force
underscore results and if we gather all
the DNS queries that it has and save it
inside that so let's check if you first
to get these information I think the DNS
query is quite slow at this point of
time let's face in able to get multiples
requests within 10 milliseconds okay we
have the first IP address for 64 for 16
and 2 1 5 and these IP addresses will
give you an idea or hint as to what will
be the range of IP addresses using in
their whole company that means from
where to where would be the range and
what range are they using as of now so
that it would be easier for you to go
ahead and get an access into their
computers so yes this is how the DNS
mapping looks like so enough with the
DNS stuff about information gathering we
have several tools but just gathering
information won't be enough to go to an
attack I will also be showing you the
DNS are even um 6 tracer DNS walk and
fears and I have shown you all of these
things remaining but I will be showing
you these in the next tutorial and as of
now I would be starting with social
engineering and how we can go ahead and
create your own key
or you can place one that you have which
is in built-in Kali Linux and Kali Linux
has n number of let me just show it out
to you rather than saying it out it
would be the interpreter command so it
would be Metasploit so I'll just type
MSF console so you can see it for
yourself that the number of payloads or
the number of viruses including Trojans
or hacking into someone's webcam
gathering information remotely through
interpreter commander opening in an SSH
command for command prompt from anyone
elses computer on your computer or
powershell command you can also go and
do these things just by using the
Metasploit console so let's go ahead and
check this out first
how many payloads we have how many
viruses we have inbuilt and it does not
only have frozen services for windows
computer we can also code and use these
to hack into another ones Linux
distribution or a Mac distribution as
well which store it can take quite a bit
of time depending upon the speed of your
processor okay perfect so we have a
total of 1389 exploits out of which 788
auxilary and 232 23 outpost auxilary
means the viruses which we need to go
ahead and implement before we go to hack
into the PC and 223 are the ones that we
get after we go ahead and hack into the
PC ayah with that I mean that let's say
once you have gained access to someone
else's computer but you don't have the
system access the root access at that
point of time we need to go ahead and
use the 2:20 remaining some of the
remaining out of these 223 post and we
have the payloads a total of 37 out of
which 8 are knobs and 37 are encoded so
yes and if you want to gather the whole
version you can still download the whole
version over here at rapid7 comm the
people who are developing Metasploit so
that would be it for this tutorial
and then I should all be starting with
social engineering and stuff and how we
can go ahead and create phishing the
pages that I showed you in one of my
previous tutorials I would be creating
that live and I'll be showing you how we
can go ahead and create that manually