-
Notifications
You must be signed in to change notification settings - Fork 16
Expand file tree
/
Copy pathdns.cheat
More file actions
90 lines (66 loc) · 8.34 KB
/
Copy pathdns.cheat
File metadata and controls
90 lines (66 loc) · 8.34 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
% DNS Enum
$ target: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' example.com; } | sort -u
$ domain: { [ -f scope.txt ] && tr '[:space:]' '\n' < scope.txt | sed '/^$/d'; printf '%s\n' example.com; } | sort -u
$ resolver: printf '%s\n' 1.1.1.1 8.8.8.8 | tr ' ' '\n'
$ reverse-lookup-ip: printf '%s\n' 127.0.0.1
$ ip_adress: printf '%s\n' 127.0.0.1
$ specific_dns: printf '%s\n' 1.1.1.1
$ file: find "$(pwd)" -type f 2>/dev/null | sort -u
$ qtype: dig -h | grep 'q\-type' | tail -n1 | cut -d '(' -f 2 | cut -d '.' -f 1 | sed 's|,|\n|g' | grep .
# $ options_dig: locate \/dig.1.gz | xargs -I {} zcat {} | grep '\fB' | grep '\.B' | head -n-5 | tail -n+4 | sed 's/.B \\fB//g' | sed 's/\\fP//g' | sed 's/\\-/-/g'
# $ target: if [[ ! -z <target> ]]; then; echo <target>; fi
$ wordlist: find "$(pwd)" "$(nix build --impure -I nixpkgs=channel:nixos-unstable --no-link --print-out-paths --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; seclists')/share/wordlists/seclists" "$(nix build --impure -I nixpkgs=channel:nixos-unstable --no-link --print-out-paths --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; wordlists')/share/wordlists" -type f 2>/dev/null | grep -i dns | sort -u
$ dns_server: echo -e '$(cat nameserver.out 2>/dev/null)\nns.<target>\nns1.<target>\nns2.<target>'
# whois on the target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ whois ]' -c whois <target>
# query the dns and export it
export dns_server=$(host -t ns $(echo '<target>' | rev | cut -d '.' -f 1,2 | rev) $(ping -c 1 <target> | head -n 1 | cut -d '(' -f 2 | cut -d ')' -f 1) | tail -n 1 | rev | awk '{print $1}' | rev | sed 's/\.$//g'); echo $dns_server
# get ns server from an hostname
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c host -t ns $(echo '<target>' | rev | cut -d '.' -f 1,2 | rev) $dns_server | tee nameserver.out
# list 'all' options with host
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c host -a <target>
# host with nameserver
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c host -l <target> $dns_server
# zonetransfer on nameserver with dnsrecon
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsrecon ]' -c dnsrecon -d <target> -t axfr -n $dns_server
# dnsenum the target
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsenum ]' -c dnsenum <target>
# nslookup with server and ns to lookup
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ coreutils ]' -c printf "server $dns_server\nset type=any\n<reverse-lookup-ip>\nexit\n" | nslookup
# gobuster basic
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ gobuster ]' -c gobuster -t 15 dns --domain <domain> --wordlist <wordlist> --show-ips
# gobuster with resolver
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ gobuster ]' -c gobuster -t 15 dns --resolver <resolver> --domain <domain> --wordlist <wordlist> --show-ips
# enum with msfconsole basic settings
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ metasploit ]' -c msfconsole -q -x 'use auxiliary/gather/enum_dns;set DOMAIN <domain>; set WORDLIST <wordlist>;options; run' # ctrl c out of it if you want to do more settings
# dig on the target, default nameserver with default q-type (a) and nameserver defined in system
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig <target>
# zonetransfer on nameserver with dig
q-type axfr <target> @$dns_server
# dig on the target with nameserver
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig q-type <qtype> <target> @$dns_server
# To use a specific query type
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig q-type <qtype> <target>
# To do a DNS reverse look up
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig -x <ip_adress> +short
# To use a specific DNS server
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig @<specific_dns> <target>
# To do a bulk DNS query (where <file> has all the domains, one to a line)
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig -f <file>
# (hack the box cheats) Identify the A record for the target domain.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup -query=A <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig <target> @$dns_server
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig a <target> @$dns_server
# (hack the box cheats) Identify the PTR record for the target IP address.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup -query=PTR <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig -x <target> @$dns_server
# (hack the box cheats) Identify ANY records for the target domain.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup -query=ANY <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig any <target> @$dns_server
# (hack the box cheats) Identify the TXT records for the target domain.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup -query=TXT <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig txt <target> @$dns_server
# (hack the box cheats) Identify the MX records for the target domain.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c nslookup -query=MX <target>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ dnsutils ]' -c dig mx <target> @$dns_server