DNS Enumeration

Understanding different DNS record types is important for reconnaissance:

• NS (Name Server): Identifies the authoritative DNS servers for a domain.
• A (Host): Maps a hostname to an IPv4 address.
• AAAA (IPv6 Host): Maps a hostname to an IPv6 address.
• MX (Mail Exchanger): Specifies the mail servers responsible for handling email for the domain.
• PTR (Pointer): Used in reverse DNS lookups to find the domain name associated with an IP address.
• CNAME (Canonical Name): Creates an alias for another hostname.
• TXT (Text): Allows storing arbitrary text data, often used for domain verification (e.g., SPF, DKIM).

Unix Tools:

• host: A simple utility for DNS lookups.

  host www.example.com
  host -t mx example.com
  host -t txt example.com
  

• DNSRecon: A more advanced Python script for DNS enumeration.

  # Standard enumeration
  dnsrecon -d example.com -t std
  # Brute-force subdomains using a wordlist
  dnsrecon -d example.com -D ~/list.txt -t brt
  

• dnsenum: Another popular DNS enumeration script.

  dnsenum example.com
  

Windows Tools:

• nslookup: The standard Windows command-line tool for querying DNS.

  nslookup mail.example.com
  # Query a specific record type against a specific DNS server
  nslookup -type=TXT info.example.com 192.168.1.1
  

• net view: Can sometimes reveal information in Windows environments (though not strictly DNS).

  net view \\dc01 /all
  

Port Scanning with Netcat (nc)

While not a dedicated port scanner like Nmap, nc can be used for basic port checks. It’s often slower and less feature-rich.

Options:

• -n: Do not resolve hostnames (faster).
• -v/-vv: Verbose output.
• -w <seconds>: Timeout for connections.
• -z: Zero-I/O mode (scan without sending data).
• -u: Scan UDP ports.

Examples:

• Basic TCP Port Scan:

  nc -nvv -w 3 -z 192.168.212.151 1-100
  

• Basic UDP Port Scan:

  nc -nv -u -z -w 1 192.168.50.149 120-123
  

• Faster Scanning with Threading (using xargs):

  # TCP Scan with 20 parallel connections
  seq 1000 10000 | xargs -P 20 -I {} nc -nvv -w 1 -z 192.168.50.151 {} 2>&1 | grep "open"
  # UDP Scan with 20 parallel connections
  seq 100 200 | xargs -P 20 -I {} nc -nvv -u -w 3 -z 192.168.159.151 {} 2>&1 | grep "open"
  

Port Scanning with Nmap

Nmap is the industry standard for port scanning and network discovery.

Windows Alternatives:

• Test-NetConnection: Built-in PowerShell cmdlet for testing network connectivity, including specific ports.

  Test-NetConnection -Port 445 192.168.50.151
  

• PowerShell Loop for Port Scanning:

  # Scan TCP ports 1-1024
  1..1024 | % { try { $tcpClient = New-Object Net.Sockets.TcpClient; $tcpClient.Connect("192.168.50.151", $_); Write-Output "TCP port $_ is open"; $tcpClient.Close() } catch {} } 2>$null
  
  # Scan the last octet for an open port (e.g., port 43)
  1..254 | ForEach-Object {
      $ip = "192.168.50.$_"
      try {
          $tcpClient = New-Object Net.Sockets.TcpClient
          $tcpClient.Connect($ip, 43)
          if ($tcpClient.Connected) { Write-Output "TCP port 43 is open on $ip"; $tcpClient.Close() }
      } catch {}
  }
  

SMB Enumeration

Server Message Block (SMB) is commonly used for file sharing in Windows environments.

• SMB Port: TCP 445
• NetBIOS Port (Legacy): TCP 139 (often used with SMB for compatibility)

Using Nmap for SMB Enumeration:

• Scan for Open SMB Ports:

  nmap -v -p 139,445 -oG smb_scan.txt 192.168.159.0/24
  grep "open" smb_scan.txt
  

• OS Discovery via SMB:

  nmap -v -p 139,445 --script smb-os-discovery 192.168.159.152
  

• List Available SMB NSE Scripts:

  ls -1 /usr/share/nmap/scripts/smb*
  

Other SMB Enumeration Tools:

• NBTScan
• Enum4Linux
• SMBClient

Windows SMB Commands:

• List shares on a remote machine:

  net view \\dc01 /all
  

SMTP Enumeration

Simple Mail Transfer Protocol (SMTP) runs on TCP port 25. Enumeration can reveal valid usernames.

Techniques:

• VRFY: Asks the server to verify an email address.
• EXPN: Asks the server for the membership of a mailing list (often disabled).

Manual Enumeration with nc:

nc -nv 192.168.50.8 25
# Connected... Server sends banner (e.g., 220 mail ESMTP Postfix)
VRFY root
# Server responds (e.g., 252 2.0.0 root)
VRFY nonexistantuser
# Server responds (e.g., 550 5.1.1 <nonexistantuser>: Recipient address rejected...)
QUIT

Using a Script (Example: vrfy.py)

A simple Python script can automate VRFY checks against a list of usernames. (See original note for script code).

Using Telnet:

Telnet can also be used for interactive SMTP sessions.

telnet 192.168.178.8 25
# Connected... Server sends banner
VRFY root
# Server responds
QUIT

Windows SMTP Checks:

• Test Connection:

  Test-NetConnection -Port 25 192.168.50.8
  

• Install and Use Telnet Client:

  # Enable Telnet Client feature if not already installed
  dism /online /Enable-Feature /FeatureName:TelnetClient
  # Connect using Telnet
  telnet 192.168.50.8 25
  

SNMP Enumeration

Simple Network Management Protocol (SNMP) typically uses UDP port 161. It can expose a wealth of system information if misconfigured.

MIB (Management Information Base):

A hierarchical database containing manageable objects on a device. OIDs (Object Identifiers) point to specific pieces of information.

Common OIDs for Enumeration:

Scanning for SNMP Hosts:

• Nmap UDP Scan:

  sudo nmap -sU --open -p 161 192.168.50.0/24 -oG open_snmp.txt
  grep "open" open_snmp.txt
  

SNMP Enumeration Tools:

• Onesixtyone: Fast scanner to check for common community strings (e.g., ‘public’, ‘private’).
• SNMPWalk: Tool to query and walk the MIB tree of an SNMP-enabled device.