DNS - FULL EXPLANATION

Enumerating DNS records with DNSenum Tool in Kali Linux

DNS stand for Domain Name System (or Service or Server), an Internet service that translates domain names into IP addresses. Because domain names are alphabetic, they’re easier to remember.

The Internet however, is really based on IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the corresponding IP address.

For example, the domain name www.way2h.blogspot.com might translate to 74.125.236.67 which is google DNS ip  this is my blog so the domain name was given by google and so this ip is google dns IP

One of the most important stages of an attack is information gathering. To be able to launch an attack, we need to gather basic information about our target. So, the more information we get, the higher is the probability of a successful attack.

Enumeration is a process that allows us to gather information from a network. We will examine DNS enumeration and SNMP enumeration techniques.

DNS enumeration is the process of locating all DNS servers and DNS entries for an organization. DNS enumeration will allow us to gather critical information about the organization such as usernames, computer names, IP addresses, and so on. To achieve this task, we will use DNSenum. For SNMP enumeration, we will use a tool called SnmpEnum. SnmpEnum is a powerful SNMP enumeration tool that allows users to analyze SNMP traffic on a network.

Navigate to Application > Kali Linux > Information Gathering > DNS Analysis > Open dnsenum

and enter the following command:

root@Kali:~# dnsenum – - enum example.com

It Will Show you Host address , Name Servers address , Mail (MX) Server and Zone Trabsfer Information.

If you want to More Powerful scan with Sub-domain, then use the following syntax.

root@Kali:~# dnsenum – - enum -f -r example.com

There are some additional options we can run using DNSenum:

- threads [number] allows you to set how many processes will run at once
-r allows you to enable recursive lookups
-d allows you to set the time delay in seconds between WHOIS requests
-o allows us to specify the output location
-w allows us to enable the WHOIS queries






Hope you enjoyed reading this tutorial! and remember this tut is only for educational purpose dont try to use again any restricted server  do it only if u awn the domain or u have rights to do so....   happy hacking hope u learn something if u have any question related to this then  do comment i will reply you :)  
  

ARP Poisoning - FULL EXPLANATION

Being one of the most active members in this WiFi board I can see that a lot of people don't understand this in depth but they only know why are we using it and what is the result. In this thread I will explain to all of you that already know something about this and to all of you that doesn't know a thing for this what exactly is ARP and ARP Poisoning. In this thread I will explain what actually happens in the background of the attack.

What is ARP ?

ARP Poisoning is one of the most famous network hacking attacks but only a few people understand what happens in the background. In order to understand this attack better first I will explain what exactly is ARP. ARP or Address Resolution Protocol is a network protocol that resolves IP addresses to MAC addresses. It is a protocol that connects the Logical Addressing(IP) with the Physical Addressing(MAC) of the networking scheme. In networking you have Layers. Imagine them as different levels. Each layer/level has his own job. These are the 7 Layers according to the OSI Model:

 The Address Resolution Protocol is between the NETWORK LAYER and the DATA LINK LAYER. I know that this looks a bit strange for those of you who haven't worked with networking but if you read a bit about the layers you will understand it better. So once again... ARP is in charge of RESOLVING IP ADDRESSES TO MAC ADDRESSES.

ARP Poisoning

Now that you understand what ARP is I can explain the ARP poisoning to you. I am not sure when exactly but people found a way to trick the ARP. Actually ARP Poisoning is a process where we send a fake or "spoofed" ARP messages to a LAN. Those actually resolve the gateway IP address to our MAC address. There for all the traffic that is meant to be for the gateway goes through US ( this is not the UNITED STATES !!! ). So actually what we do is we tell the gateway that we are the slave and we tell the slave that we are the gateway. Illustrated it looks like this:

 In this image the attacker performed ARP poisoning between 2 users on the networks. Therefor each traffic that is from slave A for slave B will first go through the attacker and then he will resend it to its original destination. And vise versa. Each traffic from slave B for slave A goes through the attacker. That is why ARP Poisoning is used for sniffing. All the traffic goes through you and you can analyze the packets passing by with no problems.