{"id":161,"date":"2021-02-26T13:59:22","date_gmt":"2021-02-26T13:59:22","guid":{"rendered":"https:\/\/cas.cybercop-training.ch\/?page_id=161"},"modified":"2021-05-31T14:23:23","modified_gmt":"2021-05-31T14:23:23","slug":"dns-scan-2","status":"publish","type":"page","link":"https:\/\/cas.cybercop-training.ch\/index.php\/dns-scan-2\/","title":{"rendered":"DNS Scan 2"},"content":{"rendered":"<h2>1. Introduction and description<\/h2>\n<blockquote>\n<p>dnsenum is a multithread script to enumerate information on a domain and to discover non-contiguous IP blocks.<\/p>\n<\/blockquote>\n<p>In addition, the tool offers added value with:<\/p>\n<ul>\n<li>Google Searches<\/li>\n<li>Brute-forcing hosts<\/li>\n<li>Whois netrange lookups<\/li>\n<li>Reverse lookups<\/li>\n<\/ul>\n<p>Please give a short description of the following points:<\/p>\n<ol>\n<li>describe the benefit of the Google option<\/li>\n<li>describe the benefit of the brute-force option<\/li>\n<li>describe the benefit of whois netrange option<\/li>\n<li>describe your lesson learned<\/li>\n<\/ol>\n<h2>2. Answer<\/h2>\n<ol>\n<li>Also known as <code>Google scraping<\/code> (allinurl: -www site:target.com) this can be helpful to find additional domains to a <code>reverse dns lookup<\/code> or when <code>zone transfer<\/code> is disabled. (It should be in most cases)<\/li>\n<li>Benefit lays in finding additional subdomains when your results on standard dns queries doesn&#8217;t satisfy you. Bruteforcenames from dnscan tool are based on research, by analysing thousands of domains.<br \/>\n<blockquote>\n<p>The first four (subdomains-100.txt, subdomains-500.txt, subdomains-1000.txt and subdomains-10000.txt) were created by analysing the most commonly occuring subomdains in approximately 86,000 zone files that were transferred as part of a separate research project. These wordlists are sorted by the popularity of the subdomains (more strictly by the percentage of zones that contained them in the dataset).<\/p>\n<\/blockquote>\n<\/li>\n<li>It calculates C Class domain ranges and perform whois queries on it, but I can&#8217;t see a real benefit of it yet.<br \/>\n<img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/02\/dn_enum1.png\" alt=\"\" \/><\/li>\n<li>The more time you spend in information gathering, the more results you get. The best thing is to combine different tools and techniques, but as we&#8217;ve allready learned in previous exercises it can be a very time consuming task.<\/li>\n<\/ol>\n<p>PDF Report:<br \/>\n<a href=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/02\/dns_enum1.pdf\" class=\"mtli_attachment mtli_pdf\" title=\"dns_enum#1\">dns_enum#1<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction and description dnsenum is a multithread script to enumerate information on a domain and to discover non-contiguous IP blocks. In addition, the tool offers added value with: Google Searches Brute-forcing hosts Whois netrange lookups Reverse lookups Please give a short description of the following points: describe the benefit of the Google option describe [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-161","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/comments?post=161"}],"version-history":[{"count":4,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/161\/revisions"}],"predecessor-version":[{"id":1346,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/161\/revisions\/1346"}],"wp:attachment":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/media?parent=161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}