Okay.
Now, to demonstrate what we learned in the theory lecture.
Now we will use the host command to find the IP address of example dot com or let's try that on google
dot com.
No problem.
So host like that, if you click it or press enter, you can see the usage is like this.
It has a lot of features and don't worry, we will have a good understanding of this tool because it
is very important.
Now host then the name of the domain so host google dot com okay.
Or sometimes not google dot com w w w dot google dot com.
By the way, you can see that we have different results.
W w instead of google dot com.
Right.
Okay.
Now let's have a look so you can see that Google Dotcom has this address.
And here it has some subdomains or whatever.
Also we have here and this is a different IP address by the way OC and have IPV six OC.
Okay.
For now.
No problem.
So far, so good.
Now, if I want to have host for Facebook dot com, for example, it has different values as well.
Now let's try this on Google dotcom.
But this time we will use the dash t option or flag and what the type of the record we want to check.
For example, the Amex record.
So you can see that these are used for the Amex, by the way.
The Mint exchange.
Now, let's have another thing, which is text to text.
And here you can see we are seeing some values.
So like domain verification, apple domain, whatever.
Google site verification and some values.
Now here we are using the type that Dashti, which is the type of the DNS records.
So just a minute.
And here you can see that like forward slash dash t to search.
Yeah, you can see here it is.
Dash T, which is the type.
If you scroll down, you can see that we have different values like these.
This option, specify the query type as you can see, see, name and as.
So text, DNS, key, etc..
Now I could use.
For what we learned from the best script section is that we want to make a brute force look up mechanism.
Okay, let's clear the screen.
Now, actually, it is a symbol.
So let's go to the desktop.
Now, let's open or make a list the the text.
Now I can see that we have first third values DNS.
Let's see, drive, gmail, whatever images, etc., etc..
Okay, this is just arbitrary list we want to use as far as search and search for subdomains inside
it.
Now here, let's use for command or for statement.
So for.
What's up RN and open the dollar sign with brackets to execute a command which is catalist the text.
Then what the semicolon do and we want to host the dollar signs up.
Dot google dot com.
Then the semicolon then then.
Och, by the way, here you can.
You need to put.
Space or here and press enter.
You can see that for Google dot com we didn't find first to Google dot com third values whatever DFES
but drive we found it as you can see and here is the record for it.
Gmail is alias for this value, whatever.
As you can see, images is an alias for this and has IP addresses.
So by this we found out we can make a brute force, which is something very good.
Okay.
Now, another practice for what we learned using the cut command.
Now let's put host Google dot com again.
It will show us these values.
All right.
Here is an exercise.
How I want to have just these values, as you can see, for one, two, three.
And I want them to be resolved to be sorted as well.
How should I do that?
We will use the pipeline in that case.
So here we don't need to have everything here.
We just want the last these.
Okay.
So let's have ten.
One, two, three, four, five.
So ten, five.
Or minus five.
I mean, you can see that.
Yeah, we have him here.
This is the first step.
Then the output will be cut, the the delimiter and it will be space.
As you can see between each one is the space until we reach the one we want.
So one, two, three, four, five, six.
So we want to have the field will be six like this as you can see.
Yeah, I made the mistake.
It's it's seven actually not six because here it is.
This is the number, right.
Seven.
No problem.
Yeah.
We have it here.
So we got the domain's the sub domains and DNS zone for Google dot com.
By the way, we can make a batch script for this.
So we can get.
Result.
Alright, something for automation and all of that stuff.
Now we have other tools in Kalanick's.
Which is the NSA recon.
So the NSA recon like that.
And as you can see, here it is.
Now, the usage is like that.
That's the the domain, which is Google, dotcom and what that city or type and what the tabs you want
a x, f, r, for example, and press enter.
Now you can see that this will show us other options.
Or other.
It seems that there is a problem here in this tool.
Let's.
Let's remove the dashed option.
Yeah.
You can see that we are seeing a different or more values than the host utility.
So as you can see, for you as an ethical hacker or hacker you need or a team member, you need to get
used to everything.
You need to write your own tools and use all the tools or various of tools, not just using one tool
because some result may be different.
And after all, we are attacking the system.
So use whatever tools you want and actually not to one tool.
Make sure you have many tools or you are learning or you have learned many tools to use.
Okay, so that's why.
So as you can see, the DNS record is showing us more information than host, as you can see.
Okay, cool.
Again, we can use best script or automation to have automation for subdomains or whatever or IPS and
etc., etc..
Now there is another tool called DNS Enum.
So DNS enum like that.
And here you can see it will show us values.
So let's try it out for Google Dotcom.
And you can see the NSA is showing more verbose style.
As you can see the host, the name is here it is the host addresses.
Here it is the exchange servers.
Here it is.
And it will start trying zone transfer or whatever.
And as you can see, it is guessing as well as you can see brute forcing and using this text DNS, the
text file, this is something already exist in Linux.
All right.
Now, let's wait a little bit just to find what we will see.
By the way, you can see it will start showing us a lot of subdomains because we are brute forcing.
So I want to press control C so to stop it.
Okay.
And here you can see we have a lot of directories or a lot of subdomains that's showing up.