Attaques sur le DNS

Transfert de zone

┌──(kali㉿kali)-[~/trick]
└─$ dig AxFR trick.htb @trick.htb
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb.              604800  IN      NS      trick.htb.
trick.htb.              604800  IN      A       127.0.0.1
trick.htb.              604800  IN      AAAA    ::1
preprod-payroll.trick.htb. 604800 IN    CNAME   trick.htb.
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
;; Query time: 95 msec
;; SERVER: 10.10.11.166#53(trick.htb) (TCP)
;; WHEN: Mon Oct 17 08:44:21 EDT 2022
;; XFR size: 6 records (messages 1, bytes 231)

Bruteforce par dictionnaire dns

┌──(kali㉿kali)-[~/Forest]
└─$ gobuster dns -d ${name}.${domain}.local -r $name -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt