DNS Enumeration
1
gem install net-dns
Copied!
In ruby script
1
require 'net/dns'
Copied!

Forward DNS lookup

The main usage is
1
require 'net/dns'
2
resolver = Net::DNS::Resolver.start("google.com")
Copied!
Returns
1
;; Answer received from 127.0.1.1:53 (260 bytes)
2
;;
3
;; HEADER SECTION
4
;; id = 36568
5
;; qr = 1 opCode: QUERY aa = 0 tc = 0 rd = 1
6
;; ra = 1 ad = 0 cd = 0 rcode = NoError
7
;; qdCount = 1 anCount = 6 nsCount = 4 arCount = 4
8
9
;; QUESTION SECTION (1 record):
10
;; google.com. IN A
11
12
;; ANSWER SECTION (6 records):
13
google.com. 31 IN A 64.233.183.102
14
google.com. 31 IN A 64.233.183.113
15
google.com. 31 IN A 64.233.183.100
16
google.com. 31 IN A 64.233.183.139
17
google.com. 31 IN A 64.233.183.101
18
google.com. 31 IN A 64.233.183.138
19
20
;; AUTHORITY SECTION (4 records):
21
google.com. 152198 IN NS ns1.google.com.
22
google.com. 152198 IN NS ns3.google.com.
23
google.com. 152198 IN NS ns4.google.com.
24
google.com. 152198 IN NS ns2.google.com.
25
26
;; ADDITIONAL SECTION (4 records):
27
ns3.google.com. 152198 IN A 216.239.36.10
28
ns4.google.com. 152198 IN A 216.239.38.10
29
ns2.google.com. 152198 IN A 216.239.34.10
30
ns1.google.com. 345090 IN A 216.239.32.10
Copied!
As you can see from response above, there are 5 sections
  • Header section: DNS lookup headers
  • Question section: DNS question,
  • Answer section: Array of the exact lookup answer (base on lookup type. ex. A, NS, MX , etc)
  • Authority section: Array of authority nameserver
  • Additional section: Array array of nameserver lookup
Since its all are objects, we can call each section like that
1
resolver.header
2
resolver.question
3
resolver.answer
4
resolver.authority
5
resolver.additional
Copied!

A record

Because the A record is the default, we can do like above example
1
resolver = Net::DNS::Resolver.start("google.com")
Copied!
or in one line to get exact answer.
1
resolver = Net::DNS::Resolver.start("google.com").answer
Copied!
will return an array with all IPs assigned to this domain
1
[google.com. 34 IN A 74.125.239.35,
2
google.com. 34 IN A 74.125.239.39,
3
google.com. 34 IN A 74.125.239.33,
4
google.com. 34 IN A 74.125.239.34,
5
google.com. 34 IN A 74.125.239.36,
6
google.com. 34 IN A 74.125.239.32,
7
google.com. 34 IN A 74.125.239.46,
8
google.com. 34 IN A 74.125.239.40,
9
google.com. 34 IN A 74.125.239.38,
10
google.com. 34 IN A 74.125.239.37,
11
google.com. 34 IN A 74.125.239.41]
Copied!

MX lookup

1
mx = Net::DNS::Resolver.start("google.com", Net::DNS::MX).answer
Copied!
returns an array
1
[google.com. 212 IN MX 40 alt3.aspmx.l.google.com.,
2
google.com. 212 IN MX 30 alt2.aspmx.l.google.com.,
3
google.com. 212 IN MX 20 alt1.aspmx.l.google.com.,
4
google.com. 212 IN MX 50 alt4.aspmx.l.google.com.,
5
google.com. 212 IN MX 10 aspmx.l.google.com.]
Copied!

All lookup

1
any = Net::DNS::Resolver.start("facebook.com", Net::DNS::ANY).answer
Copied!
returns
1
[facebook.com. 385 IN A 173.252.120.6,
2
facebook.com. 85364 IN TXT ,
3
facebook.com. 149133 IN NS b.ns.facebook.com.,
4
facebook.com. 149133 IN NS a.ns.facebook.com.]
Copied!
for list of types, please refer to the gem docs

Reverse DNS lookup

1
resolver = Net::DNS::Resolver.new
2
query = resolver.query("69.171.239.12", Net::DNS::PTR)
Copied!
If you want to specify the nameserver(s) to use, it support an array of nameserver
1
resolver = Net::DNS::Resolver.new(:nameserver => "8.8.8.8")
Copied!
or update the object
1
resolver = Net::DNS::Resolver.new
2
resolver.nameservers = ["8.8.4.4" , "8.8.8.8"]
Copied!
Last modified 3yr ago