Hello everyone in this
video. We are going to see the DNS Brute
Force scan.
So the syntax of doing this scan is nmap the
target IP address followed by hyphen hyphen
script equals to DNS - route dot
NSE
remember it is not important. If you give dot NAC
as nmap automatically understands that
and runs the script.
So you can scan a Target by simply giving an IP address
and specify the DNS brood dot NEC script
which will give us the DNS server results.
and hosted applications on the server
if any
you can always add hyphen V to see the output in verbose mode.
The example to do this scan is given over here.
So
it is the Practical time.
And let's see this scan in action where we
try to identify the DNS
brute results of any web server.
so as you can see on the terminal I have
given the command which is nmap -
P Port 80
Followed by hyphen hyphen script dnsbrood dot
NEC which means I'm going to use this particular script
on the target, which is well and
web.com.
This is a target which is made deliberately vulnerable
to test for.
So, let's see if we get any.
DNS Brute Force results on this particular
web server
Let me Skip and directly jump
to the output.
And you can see we did not get any results as
you can see the output of the script is
here which means no other
records are written onto the same.
Particular web server. There are no a records
Triple A records MX records something like
that.
So let's change our Target.
And choose scan me Dot nmap.org.
And let's see that if we get sum of
the DNS records from this particular
web server.
Let's skip this part and directly jump
to the output.
Perfect. As you can see, we have got
the output for the DNS brute script
and we can see that we have identified IPv6
dot nmap.org is
one of the host names which has
the following IPv6 IP address.
Similarly, we have found out chat dot nmap.org
is again one of the host name
which has this particular IP address.
If You observe this IP address and
this IP address both are same of
both the target domains which means
this particular domain is hosted onto
the same server but under one record,
which is a subdomain which
is chat Dot nmap.org
If you can see we have identified.
one
this record a record and one more.
AAA record which contains a IPv6 address
So this was the output of DNS Brute
Force you can use this particular scan.
For brute forcing the DNS names on bug
Bounty programs and Bug Bounty targets.
It will be very useful if any
Target is having a very big
scope and runs so many applications on
the DNS server, then you
may be able to identify a lot
of Juicy information from the DNS Brute Force
results.
I hope you guys understood this video. Thank you.