Everybody welcome to the next video.
So in this video we've talked briefly about DNS before we were setting up the windows machine.
But what I want to do is I want to dive a little bit deeper into what DNS is and how it works.
So DNS stands for Domain Name System.
This is used mainly to resolve host names to an IP address.
Now a good way to think of this as your cell phone as an example has a DNS server on it.
So what I mean by this is let's say you have your you have contacts in your phone which have a name
associated to a phone number.
Now think of the name as a hostname or F and or a fully qualified domain name and the phone number is
an IP address.
When you place a call you don't place a call to a name.
You place a call to a phone number.
So when you click a name your phone transfer resolves that to a phone number and then places the call.
This is no different than a server when you type in Google dot com.
It's resolving the contact quote contact name Google dot com into an IP address or a phone number that
can be used to contact the end service that you're wanting talk to.
Now the entire Internet relies on DNS.
This is important because we wouldn't remember everybody's phone number just like an on your phone you
don't remember everybody's phone number.
Maybe you do but most people don't remember everybody's phone number that's in that's in their phone.
That's why we have contact lists you have of you have a name to a phone number so you don't have to
remember the phone number to everybody's name.
Now this is important for enterprise environments for stuff like load balancing or A.J. for high availability
where we're resolving host names is very very important to keeping the network running.
We'll go over load balancing and A.J. and high availability in another video but just understand that
it's very important for that when you have if you can't resolve an IP address that might let's say an
IP address needs to resolve to five or hostname needs to resolve to five different eyepiece.
If it can't resolve to that now the application needs to be able to understand and talk to all five.
But how do you balance that.
It becomes a little bit more of a complicated matter than just giving it one IP and just balancing it
itself.
Now how does this work.
We're going to hit this at a pretty high level.
What I want you to do after this is run through and test it out on the windows machine and getting it
and understanding how this works.
You can use a command called n s look up and s look up on Windows as well as Linux to look up Google
dot com as an example.
So when you type w w dot Red Team nation dot com into your browser the operating system will look for
a local DNS server that was setup.
So this is the one that we saw when we configured the Windows machine as the DNS server which is important
this might in most cases will be a router for enterprise IT WILL BE THE LOCAL DNS server that they have
now the OS will interact with the local DNS client that it has installed to connect to the DNS server
at the router next what I wanted to say before is the DNS the operating system will check to see if
it already knows what the IP addresses so there's there's a there's a hosts file on windows and a resolve
file on Linux that you can give a hostname in an IP match that the DNS client locally will look up there
first and then it will go out and check the configured DNS server and send the request out to that.
Just know that that does happen.
So in case you as an attacker want to override Google dot com or some sort of internal portal to be
you you can do that on a host so that anybody logging in on that machine will then get redirected without
them knowing that or any network device such as an intrusion detection system or a firewall knowing
any of the wiser now whatever is when a router gets requests it it'll go through its recursive resolve
or now I'm to explain what that is in the second the router will check its own local DNS server in case
it has one's installed for the domain read team nation dot com.
If it's located it will give the IP address directly if it doesn't it will continue with its process.
Now the recursive resolve or basically will take the domain as a and split it up in two into three parts
the dot com part is the first part read termination is the second part and then w w w dot is the last
part now breaks it up in that reverse order.
So because it has to resolve each step because there's more than just e-commerce dot net dot org dot
dot uk dot gov there's a lot of this is called a root level server which is where the dot com is.
So it has to resolve it backwards and needs to resolve a dot com server then needs to resolve the domain
Red Team nation which will go over to second so when router looks at its own DNS settings it identifies
the root server configured for dot com which is normally built in by the ISP or the router itself.
We'll have we'll have the setting in in one way shape or form.
It will your router or your ISP router will have this.
So the root server as I said before looks up the dot com.
So once it finds this root server it'll send a DNS request to that route dot com server to resolve WW
dot resignation.
So the root server has a setting of called TTL or top level domain DNS servers.
Now what this is this is the next step in the phase where I said it was dot com and then now the top
level domain is Red Team nation in this case.
So the TLT node the name server of the domain you're trying to reach a K Red Team nation dot com and
these what's important understand here is DNS servers sync with each other so Internet based DNS servers
such as Google's any anybody else's really any public DNS servers are all sync together and normally
for example I go Daddy head when you're hosting a Web site you will also have their DNS server which
is public as well which syncs to everybody else.
So when you reach the TLT that server has been seeing with everybody else that's public.
And as long as it's been an authoritative server now you can't just bring up a DNS server habits and
say I own Google dot com or automation dot com and have it just redirect to you.
Now there are attacks that allow you to poison that to make it happen.
And there are attacks going around now in 2018 that have that.
However it's not common You can't just bring up a standard DNS server and just hope it works.
So a tale D knows the name or the actual name server DNS server that you've configured on your domain
or or anybody else's domain.
In this case red team nation has its own DNS servers.
Now the request is forwarded so DNS server that the domain controls or that the domain is registered
to.
That will then resolve the IP address when the IP address is resolved.
It sends itself back through all of the DNS servers that it went that it went through to get to you.
Which is why the recursive Miss happens here.
So it sends of all the way back and then eventually gets to the client and then the first router will
cache this domain name and the IP for future use so it can look up pretty pretty quickly.
Most routers have this in place by default just holds a small amount of domains.
So stuff like you access on a frequent basis it will just start storing that.
So this is how DNS works at a high level.
If you want to look at more feel free to dig in a little bit this is this can get much bigger.
When you start looking at reverse look ups and there's a lot more to it.
So I want you to go out and take a look at how DNS works that a little bit of a deeper level.