dns-pentest

name	dns-pentest
description	Guides DNS name resolution service penetration testing. Use when port 53 is discovered during scanning or when DNS is identified on a target.

DNS Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Do not run recursion amplification attacks. Document only.

Ports and detection

Port	Service
53/tcp, 53/udp	DNS
5353/udp	mDNS (related enumeration)

Version fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/enum_dns",
  engagement_id="<id>",
  options={"DOMAIN": "<domain>", "NAMESERVER": "<target>", "THREADS": 5}
)

CLI fallback:

dig version.bind CHAOS TXT @<target>
nmap -sU -sT -p53 --script dns-nsid,dns-recursion <target>
fpdns <target>

Workflow

Task Progress:
- [ ] Version and banner fingerprint
- [ ] Zone transfer (AXFR) attempt
- [ ] SPF/DMARC/DKIM record review
- [ ] Subdomain and SRV enumeration
- [ ] DNSSEC NSEC walking
- [ ] Document findings

Zone transfer (AXFR)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/enum_dns",
  engagement_id="<id>",
  options={"DOMAIN": "<domain>", "NAMESERVER": "<target>"}
)

CLI fallback:

dig axfr @<target> <domain>
dig axfr @<target>
fierce --domain <domain> --dns-servers <target>
dnsrecon -d <domain> -a -n <target>

Record queries

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/enum_dns",
  engagement_id="<id>",
  options={"DOMAIN": "<domain>", "NAMESERVER": "<target>"}
)

CLI fallback:

dig ANY @<target> <domain>
dig A <domain> @<target>
dig AAAA <domain> @<target>
dig MX <domain> @<target>
dig NS <domain> @<target>
dig TXT <domain> @<target>
dig SOA <domain> @<target>
dig -x <IP> @<target>
host -a <domain> <target>

SPF / DMARC / DKIM queries

MSF: No direct module; use CLI.

CLI fallback:

dig txt <domain> @<target>
dig txt _dmarc.<domain> @<target>
dig txt default._domainkey.<domain> @<target>
dig mx <domain> @<target>
# Weak SPF: +all, ~all with no strict includes
# Weak DMARC: p=none or no record
host -t TXT <domain> <target>

Subdomain brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/enum_dns",
  engagement_id="<id>",
  options={"DOMAIN": "<domain>", "NAMESERVER": "<target>"}
)

CLI fallback:

dnsenum --dnsserver <target> --enum -f wordlist.txt <domain>
dnsrecon -D wordlist.txt -d <domain> -n <target>
for sub in $(cat wordlist.txt); do dig $sub.<domain> @<target> +short; done
subfinder -d <domain> -nW

Active Directory SRV records

MSF: No direct module; use CLI.

CLI fallback:

dig -t _ldap._tcp.<domain> @<target>
dig -t _kerberos._tcp.<domain> @<target>
dig -t _gc._tcp.<domain> @<target>
dig -t _kpasswd._tcp.<domain> @<target>
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='<domain>'" <target>

DNSSEC NSEC walking

MSF: No direct module; use CLI.

CLI fallback:

# Enumerate zone via NSEC record chaining (when DNSSEC misconfigured)
dnswalk <domain> @<target>
ldns-walk <domain> @<target>
nsec3walker - <domain>   # for NSEC3 with hash cracking
# Manual: dig NSEC next.<domain> @<target>
dig +dnssec <domain> @<target>
dig NSEC <domain> @<target>

Reverse DNS brute force

MSF: No direct module; use CLI.

CLI fallback:

dnsrecon -r 10.0.0.0/24 -n <target>
dnsrecon -r <target>/24 -n <target>
for i in $(seq 1 254); do dig -x 10.0.0.$i @<target> +short; done

dnschef setup (poisoning lab)

MSF: No direct module; use CLI.

CLI fallback:

# Intercept and spoof DNS responses (authorized lab / MITM scope only)
dnschef --interface 0.0.0.0 --fakeip <attacker_ip> --fakedomains *.target.local,<domain>
dnschef -f dns.conf   # custom A record mappings
# Pair with ARP/DNS spoofing on LAN
echo "A *.target.local <attacker_ip>" > dns.conf

Dynamic DNS update abuse

MSF: No direct module; use CLI.

CLI fallback:

nsupdate -v
# server <target>
# zone <domain>
# update add test.<domain> 300 A 10.0.0.1
# send

Recursion check (document only)

MSF: No direct module; use CLI.

CLI fallback:

dig google.com A @<target>
# If "ra" flag set in response, open recursion
nmap --script dns-recursion -p53 <target>

Do not weaponize for amplification (ROE forbids DoS).

DNS rebinding (web context)

MSF: No direct module; use CLI.

CLI fallback:

# Register domain with short TTL alternating attacker and internal IP
# Use rebinding service or custom DNS server
# Relevant for bypassing same-origin in browsers (see web-app-pentest)

Post-access

• Map internal hosts from AXFR/subdomain results for port scanning
• Identify mail servers (MX), DCs (SRV), dev/staging subdomains
• Feed discovered hostnames into msf-recon workflow

Related skills

• web-app-pentest - DNS rebinding in web context
• internal-ad-pentest - AD SRV record discovery
• smtp-pentest - MX record enumeration