Instructor: In this video, we'll see how
we can get comprehensive DNS information
about the target website.
So just to give you a quick refresh on what DNS is,
so when you type in facebook.com,
a DNS server will convert that name to an IP address.
Now, the process is a bit more complicated.
So the DNS server contains actually a number of records
each pointing to a different domain or to a different IP,
sometimes to the same IP.
So but in general, you request a domain name,
it gets converted to an IP address, and depending on that,
these information needs to be stored somewhere.
So we're gonna query this DNS server
and see what information we can get through it.
Now we're gonna use a website called Robtext.com.
And I'm just gonna put the target website
that I want to get information about.
So I'm gonna type isecurity.org.
And I'm gonna hit Enter to get a report.
Now, as you can see, we will get a big report.
So there is a lot of information in here.
But you can actually use the buttons in here
to navigate to any of the sections below.
So if you wanna directly go to the records
or to go to the SEO, all you have to do is
just click in here and you'll go directly to that section.
What we're gonna do right now though,
we'll go over all the sections one by one
and see what kind of information we got.
Now keep in mind, the order of this information
might be different, but you should have the same sections.
So, and the analysis, you can see
we have general information about the target.
So you can see that it's telling us that Isecurity
has three name servers, five mail servers,
and one IP address.
We can see the name servers used by Isecurity.
And Digital Ocean is the hosting company that Isecurity
is using at the time of recording this lecture.
So this is very, very useful, because you can go
to Digital Ocean right now, you'll see the hosting company,
and then you can pretend to be them
and communicate with Isecurity, telling them
that you're signing them up for a better hosting,
you're giving them something because they are a VIP customer
and ask them to log in.
Obviously, they'll be logging in to a fake login page
and that way you'll steal their information.
You can tell them that there is a policy change
that they have to accept.
And again, ask them to log in
and steal the information that way.
Obviously, you'll do this through a fake login page.
And this is mostly social engineering,
so it's nothing to do with websites hacking,
and I cover all this in my Social Engineering Course.
But it's very useful because if you couldn't hack
into the websites through the applications installed,
then the only way to get in is using social engineering.
Now, below this, we can see that the target
is using Google mail servers.
So they're not handling their own emails,
they're using Google to handle their emails.
Again, you can communicate with the target pretending
to be Google and get them to do something,
or to log into a fake page and steal information that way.
You can also see the IP address of this website,
which can be used to discover other websites installed
on the same server, and this is very, very useful
because if you couldn't hack into your target website
through the applications installed on that website,
then you can try to hack
into any website installed on the same server.
And if you manage to do that,
then you You can actually navigate to your targets website,
because they're all essentially installed
on the same computer.
And we'll talk more about that in the next lecture.
And below right here we have
a number of similar domains to our target.
Now, these might be completely irrelevant,
but you can have a look and see what you have.
Navigating to the Quick Info, again you can see
the domain name, you can see the TLD.
We have the IP address, the name servers.
Again like I said, they're useful
because they usually give us information
about the domain hosting company
or the hosting company hosting the website itself.
And we also have the mail servers
like we seen before, it's Google Mail.
So that all can be really really useful.
The reverse section will perform Reverse DNS Lookup.
So as I said at the start of the lecture,
DNS is used to translate domain names into IP addresses.
And a Reverse Lookup, we use the IP address
to see which domains link to this IP address.
And like I said previously, this can be very, very useful,
because we'll be able to discover other websites hosted
on the same server, and we can hack into
any of these websites
and from there gain access to our target.
But with the Reverse Lookup, you won't always get
all the websites installed on the same server.
Therefore, in the next lecture,
I will show you a better way of doing that.
But if you really wanna see the the results
of the Reverse Lookup, you'll have to log in.
So I'm actually gonna open a new tab,
I'm gonna go to Robtext again.
And I'm gonna click on login right here.
And the only way to login to Robtext right now
is through Google, so gonna click on Google,
I'm gonna click my email.
And that's it, we're logged in.
So I'm gonna close this.
And we're gonna refresh in here.
And if we scroll down again to the Reverse, right here,
we have the results of the Reverse Lookup.
And you can either download this as a CSV
or view it as HTML.
So I'm gonna choose to view it as HTML in a new tab.
And right here, as you can see, we only have Zsecurity
on its own, because Zsecurity
is hosted on its own server.
So there are no other websites installed on the same server.
But like I said, if there are other websites hosted
on the same server, then you'll be able to see them
in here in the Reverse Lookup.
Now going down, we can see
a more detailed breakdown of the DNS records.
So you can see here we have information about the A record.
And this is the record that's used to translate
the domain name into an IP address.
So you can see that isecurity.org links to this IP address,
which is the IP address of the server hosting
or containing the files of the website.
Scrolling down, we have more SEO information
Search Engine Optimization info,
we have the web trust reputation of this website,
we have the Alexa ranking.
In the share tab, we have the IP of the target website.
Again, like I said, we can use this
to get websites installed on the same server.
We have a graph representation
of all the information we gathered.
We also have a history section,
this is actually very, very useful because you can use this
to track all the changes to the DNS info
of the target website.
So you can see when they started using Google,
you can see when they started using Digital Ocean
as their hosting provider.
So if we scroll down, we might actually be able to see
that they were using a different provider.
And here you go, we can see that they were using
a different hosting company.
This one right here, Dimofinf,
I hope I'm pronouncing that right.
But right now, as we can see, they changed and they switched
to a different hosting company, Digital Ocean.
So again, you can even contact them pretending
to be this company, and tell them
that you're gonna sign them up for a better offer
or pretend that they violated one of your terms
and conditions, and ask them to login to do something.
When they login, you can serve them a fake file,
a backdoor or again use the login information,
get them to login through our fake web page
and steal the username and password.
So, information is always very, very useful
when it comes to hacking,
especially if you wanna perform a social engineering attack,
which might be your last resort if you could not hack
into the website using the applications installed on it.
Scrolling down we can see we have the Whois information,
we had a full lecture on how to get this
and how this can be useful.
And finally, we have the DNS block information,
which basically is a list of websites known to send spam.
So usually email sent from these websites
would be blocked or considered as spam.
So as you can see a very useful website that can be used
to get information about the server used
to host the target website and its relationship
with other websites, other servers.
Which hosting companies are being used.
And like I said, all of this can be very, very useful
whether you want to target the website itself,
whether you wanna target other websites
so you can hack into your target website.
And even if you want to social engineer one of the admins
to gain access to your target website.