1. DNS Reconnaissance Tools

Here’s a consolidated table organizing all the techniques into categories for better readability and quick reference.

1.1. Reconnaissance & Enumeration Techniques

1.2. Passive Reconnaissance

1.3. Active Reconnaissance

1.4. Web Application Attack Surface

1.5. Web Exploitation & Attacks

1.6. Miscellaneous Reconnaissance

2. Introduction to DNS - Number to Letter

The Domain Name System (DNS) is fundamental to how the internet works, translating human-readable domain names (e.g., example.com) into machine-readable IP addresses (e.g., 192.168.1.1).

sequenceDiagram
    participant User
    participant Resolver as DNS Resolver
    participant RootDNS as Root DNS Server
    participant TLD as TLD Server (.com, .net)
    participant AuthDNS as Authoritative DNS Server
    participant Attacker as Malicious DNS Server

    User->>Resolver: Request IP for example.com
    Resolver->>RootDNS: Query for example.com
    RootDNS->>TLD: Forward request to .com TLD
    TLD->>AuthDNS: Forward request to example.com DNS
    AuthDNS->>Resolver: Respond with IP of example.com
    Resolver->>User: Respond with correct IP

    Note over Attacker: Spoofing Attempt
    Attacker-->>Resolver: Inject fake response (malicious.com)
    Resolver->>User: Provides fake IP
    User->>Attacker: Connects to fake website unknowingly

3. Common DNS Attack Tactics

3.1 DNS Spoofing (Cache Poisoning)

DNS Spoofing, also known as DNS Cache Poisoning, occurs when an attacker injects fraudulent DNS records into a resolver’s cache. This redirects users from a legitimate website to a malicious one.

Example Attack Flow

sequenceDiagram
    participant User
    participant Resolver as DNS Resolver
    participant Attacker as Malicious Server

    User->>Resolver: Request IP for example.com
    Resolver->>Attacker: Query for example.com
    Attacker-->>Resolver: Respond with IP of malicious.com
    Resolver->>User: Provides IP of malicious.com
    User->>Attacker: Connects to fake website unknowingly

3.2 DNS Amplification (DDoS on DNS)

A Distributed Denial-of-Service (DDoS) attack abuses misconfigured DNS servers to generate large responses to small requests, overwhelming a target server.

Example Attack Flow

sequenceDiagram
    participant Attacker
    participant Resolver as Open DNS Resolver
    participant Target as Victim Server

    Attacker->>Resolver: Sends DNS query spoofed with Target's IP
    Resolver->>Target: Sends amplified DNS response to Target
    Target->>Target: Overwhelmed with traffic and crashes

3.3 Subdomain Takeover

Subdomain takeover occurs when a dangling DNS record (pointing to an unclaimed cloud service) is hijacked by an attacker.

Example Attack Flow

sequenceDiagram
    participant Attacker
    participant DNS as DNS Provider
    participant Victim as Unclaimed Cloud Service

    Attacker->>DNS: Registers the unclaimed subdomain
    DNS->>Attacker: Assigns control to Attacker
    Attacker->>Users: Hosts phishing or malicious content

4. Tools for DNS Security

To mitigate DNS-based attacks, organizations use a combination of preventive and reactive security tools: