Instructor: In this video, we'll see how 2 2
we can get comprehensive DNS information 3 3
about the target website. 4 4
So just to give you a quick refresh on what DNS is, 5 5
so when you type in facebook.com, 6 6
a DNS server will convert that name to an IP address. 7 7
Now, the process is a bit more complicated. 8 8
So the DNS server contains actually a number of records 9 9
each pointing to a different domain or to a different IP, 10 10
sometimes to the same IP. 11 11
So but in general, you request a domain name, 12 12
it gets converted to an IP address, and depending on that, 13 13
these information needs to be stored somewhere. 14 14
So we're gonna query this DNS server 15 15
and see what information we can get through it. 16 16
Now we're gonna use a website called Robtext.com. 17 17
And I'm just gonna put the target website 18 18
that I want to get information about. 19 19
So I'm gonna type isecurity.org. 20 20
And I'm gonna hit Enter to get a report. 21 21
Now, as you can see, we will get a big report. 22 22
So there is a lot of information in here. 23 23
But you can actually use the buttons in here 24 24
to navigate to any of the sections below. 25 25
So if you wanna directly go to the records 26 26
or to go to the SEO, all you have to do is 27 27
just click in here and you'll go directly to that section. 28 28
What we're gonna do right now though, 29 29
we'll go over all the sections one by one 30 30
and see what kind of information we got. 31 31
Now keep in mind, the order of this information 32 32
might be different, but you should have the same sections. 33 33
So, and the analysis, you can see 34 34
we have general information about the target. 35 35
So you can see that it's telling us that Isecurity 36 36
has three name servers, five mail servers, 37 37
and one IP address. 38 38
We can see the name servers used by Isecurity. 39 39
And Digital Ocean is the hosting company that Isecurity 40 40
is using at the time of recording this lecture. 41 41
So this is very, very useful, because you can go 42 42
to Digital Ocean right now, you'll see the hosting company, 43 43
and then you can pretend to be them 44 44
and communicate with Isecurity, telling them 45 45
that you're signing them up for a better hosting, 46 46
you're giving them something because they are a VIP customer 47 47
and ask them to log in. 48 48
Obviously, they'll be logging in to a fake login page 49 49
and that way you'll steal their information. 50 50
You can tell them that there is a policy change 51 51
that they have to accept. 52 52
And again, ask them to log in 53 53
and steal the information that way. 54 54
Obviously, you'll do this through a fake login page. 55 55
And this is mostly social engineering, 56 56
so it's nothing to do with websites hacking, 57 57
and I cover all this in my Social Engineering Course. 58 58
But it's very useful because if you couldn't hack 59 59
into the websites through the applications installed, 60 60
then the only way to get in is using social engineering. 61 61
Now, below this, we can see that the target 62 62
is using Google mail servers. 63 63
So they're not handling their own emails, 64 64
they're using Google to handle their emails. 65 65
Again, you can communicate with the target pretending 66 66
to be Google and get them to do something, 67 67
or to log into a fake page and steal information that way. 68 68
You can also see the IP address of this website, 69 69
which can be used to discover other websites installed 70 70
on the same server, and this is very, very useful 71 71
because if you couldn't hack into your target website 72 72
through the applications installed on that website, 73 73
then you can try to hack 74 74
into any website installed on the same server. 75 75
And if you manage to do that, 76 76
then you You can actually navigate to your targets website, 77 77
because they're all essentially installed 78 78
on the same computer. 79 79
And we'll talk more about that in the next lecture. 80 80
And below right here we have 81 81
a number of similar domains to our target. 82 82
Now, these might be completely irrelevant, 83 83
but you can have a look and see what you have. 84 84
Navigating to the Quick Info, again you can see 85 85
the domain name, you can see the TLD. 86 86
We have the IP address, the name servers. 87 87
Again like I said, they're useful 88 88
because they usually give us information 89 89
about the domain hosting company 90 90
or the hosting company hosting the website itself. 91 91
And we also have the mail servers 92 92
like we seen before, it's Google Mail. 93 93
So that all can be really really useful. 94 94
The reverse section will perform Reverse DNS Lookup. 95 95
So as I said at the start of the lecture, 96 96
DNS is used to translate domain names into IP addresses. 97 97
And a Reverse Lookup, we use the IP address 98 98
to see which domains link to this IP address. 99 99
And like I said previously, this can be very, very useful, 100 100
because we'll be able to discover other websites hosted 101 101
on the same server, and we can hack into 102 102
any of these websites 103 103
and from there gain access to our target. 104 104
But with the Reverse Lookup, you won't always get 105 105
all the websites installed on the same server. 106 106
Therefore, in the next lecture, 107 107
I will show you a better way of doing that. 108 108
But if you really wanna see the the results 109 109
of the Reverse Lookup, you'll have to log in. 110 110
So I'm actually gonna open a new tab, 111 111
I'm gonna go to Robtext again. 112 112
And I'm gonna click on login right here. 113 113
And the only way to login to Robtext right now 114 114
is through Google, so gonna click on Google, 115 115
I'm gonna click my email. 116 116
And that's it, we're logged in. 117 117
So I'm gonna close this. 118 118
And we're gonna refresh in here. 119 119
And if we scroll down again to the Reverse, right here, 120 120
we have the results of the Reverse Lookup. 121 121
And you can either download this as a CSV 122 122
or view it as HTML. 123 123
So I'm gonna choose to view it as HTML in a new tab. 124 124
And right here, as you can see, we only have Zsecurity 125 125
on its own, because Zsecurity 126 126
is hosted on its own server. 127 127
So there are no other websites installed on the same server. 128 128
But like I said, if there are other websites hosted 129 129
on the same server, then you'll be able to see them 130 130
in here in the Reverse Lookup. 131 131
Now going down, we can see 132 132
a more detailed breakdown of the DNS records. 133 133
So you can see here we have information about the A record. 134 134
And this is the record that's used to translate 135 135
the domain name into an IP address. 136 136
So you can see that isecurity.org links to this IP address, 137 137
which is the IP address of the server hosting 138 138
or containing the files of the website. 139 139
Scrolling down, we have more SEO information 140 140
Search Engine Optimization info, 141 141
we have the web trust reputation of this website, 142 142
we have the Alexa ranking. 143 143
In the share tab, we have the IP of the target website. 144 144
Again, like I said, we can use this 145 145
to get websites installed on the same server. 146 146
We have a graph representation 147 147
of all the information we gathered. 148 148
We also have a history section, 149 149
this is actually very, very useful because you can use this 150 150
to track all the changes to the DNS info 151 151
of the target website. 152 152
So you can see when they started using Google, 153 153
you can see when they started using Digital Ocean 154 154
as their hosting provider. 155 155
So if we scroll down, we might actually be able to see 156 156
that they were using a different provider. 157 157
And here you go, we can see that they were using 158 158
a different hosting company. 159 159
This one right here, Dimofinf, 160 160
I hope I'm pronouncing that right. 161 161
But right now, as we can see, they changed and they switched 162 162
to a different hosting company, Digital Ocean. 163 163
So again, you can even contact them pretending 164 164
to be this company, and tell them 165 165
that you're gonna sign them up for a better offer 166 166
or pretend that they violated one of your terms 167 167
and conditions, and ask them to login to do something. 168 168
When they login, you can serve them a fake file, 169 169
a backdoor or again use the login information, 170 170
get them to login through our fake web page 171 171
and steal the username and password. 172 172
So, information is always very, very useful 173 173
when it comes to hacking, 174 174
especially if you wanna perform a social engineering attack, 175 175
which might be your last resort if you could not hack 176 176
into the website using the applications installed on it. 177 177
Scrolling down we can see we have the Whois information, 178 178
we had a full lecture on how to get this 179 179
and how this can be useful. 180 180
And finally, we have the DNS block information, 181 181
which basically is a list of websites known to send spam. 182 182
So usually email sent from these websites 183 183
would be blocked or considered as spam. 184 184
So as you can see a very useful website that can be used 185 185
to get information about the server used 186 186
to host the target website and its relationship 187 187
with other websites, other servers. 188 188
Which hosting companies are being used. 189 189
And like I said, all of this can be very, very useful 190 190
whether you want to target the website itself, 191 191
whether you wanna target other websites 192 192
so you can hack into your target website. 193 193
And even if you want to social engineer one of the admins 194 194
to gain access to your target website.