DNSmap obteniendo subdominios, ya hemos hablado aquí en DragonJAR varias veces de la etapa de fingerprinting que forma parte de un pentest y de como se ha de realizar correctamente para que la auditoría vaya rodada. Cuantos más información podamos obtener en esta etapa, será mucho más sencillo el trabajo posterior.
Otra de las herramientas que podemos añadir a nuestro arsenal de fingerprinting es DNSmap, esta herramienta hará una faena muy importante y es encontrar los subdominios relacionados con un dominio en concreto.
Tabla de Contenido
DNSmap obteniendo subdominios ¿Esto en que nos puede ayudar?
Pues lo mas probable es que distintos subdominios estén dando distintos servicios que igual no han surgido una fortificación tan robusta como el dominio principal.
La herramienta tiene unos parámetros muy sencillos, vamos a ver algunos de los casos que podemos encontrar en Internet.
Uso de DNSmap
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | darkmac:Desktop marc$ dnsmapdnsmap 0.30 - DNS Network Mapper by pagvac (gnucitizen.org)usage: dnsmap <target-domain> [options]options:-w <wordlist-file>-r <regular-results-file>-c <csv-results-file>-d <delay-millisecs>-i <ips-to-ignore> (useful if you're obtaining false positives)e.g.:dnsmap target-domain.foodnsmap target-domain.foo -w yourwordlist.txt -r /tmp/domainbf_results.txtdnsmap target-fomain.foo -r /tmp/ -d 3000dnsmap target-fomain.foo -r ./domainbf_results.txt |
Wikileaks
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | darkmac:Desktop marc$ dnsmap wikileaks.org -r wikileaks_dnmap.txtdnsmap 0.30 - DNS Network Mapper by pagvac (gnucitizen.org)[+] searching (sub)domains for wikileaks.org using built-in wordlist[+] using maximum random delay of 10 millisecond(s) between requestschat.wikileaks.orgIP address #1: 141.101.123.19IP address #2: 141.101.112.19IP address #3: 141.101.113.19IP address #4: 190.93.240.19IP address #5: 190.93.241.19mail.wikileaks.orgIP address #1: 94.23.165.55mx.wikileaks.orgIP address #1: 94.23.165.55search.wikileaks.orgIP address #1: 190.93.241.19IP address #2: 190.93.240.19IP address #3: 141.101.113.19IP address #4: 141.101.112.19IP address #5: 141.101.123.19shop.wikileaks.orgIP address #1: 190.93.241.19IP address #2: 190.93.240.19IP address #3: 141.101.113.19IP address #4: 141.101.112.19IP address #5: 141.101.123.19www.wikileaks.orgIP address #1: 190.93.241.19IP address #2: 190.93.240.19IP address #3: 141.101.113.19IP address #4: 141.101.112.19IP address #5: 141.101.123.19[+] 6 (sub)domains and 22 IP address(es) found[+] regular-format results can be found on wikileaks_dnmap.txt[+] completion time: 506 second(s) |
Twitter en DNSmap obteniendo subdominios
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 | darkmac:Desktop marc$ dnsmap twitter.com -r dnsmap_twitter.txtdnsmap 0.30 - DNS Network Mapper by pagvac (gnucitizen.org)[+] searching (sub)domains for twitter.com using built-in wordlist[+] using maximum random delay of 10 millisecond(s) between requests0.twitter.comIP address #1: 199.16.156.47blog.twitter.comIP address #1: 199.16.156.41IP address #2: 199.16.156.9IP address #3: 199.16.156.73de.twitter.comIP address #1: 199.16.156.41IP address #2: 199.16.156.9IP address #3: 199.16.156.73download.twitter.comIP address #1: 199.16.156.18en.twitter.comIP address #1: 199.16.156.9IP address #2: 199.16.156.73IP address #3: 199.16.156.41es.twitter.comIP address #1: 199.16.156.9IP address #2: 199.16.156.73IP address #3: 199.16.156.41fr.twitter.comIP address #1: 199.16.156.9IP address #2: 199.16.156.73IP address #3: 199.16.156.41groups.twitter.comIP address #1: 199.16.156.47help.twitter.comIP address #1: 199.16.156.47it.twitter.comIP address #1: 199.16.156.105IP address #2: 199.16.156.73IP address #3: 199.16.156.41ja.twitter.comIP address #1: 199.16.156.105IP address #2: 199.16.156.73IP address #3: 199.16.156.41jp.twitter.comIP address #1: 199.16.156.105IP address #2: 199.16.156.73IP address #3: 199.16.156.41m.twitter.comIP address #1: 199.16.156.47mail.twitter.comIP address #1: 199.16.156.47media.twitter.comIP address #1: 199.16.156.47mobile.twitter.comIP address #1: 199.16.156.107IP address #2: 199.16.156.43mx.twitter.comIP address #1: 199.59.148.219IP address #2: 199.59.149.107mx1.twitter.comIP address #1: 199.59.148.144mx2.twitter.comIP address #1: 199.59.148.205mx3.twitter.comIP address #1: 199.59.148.207p.twitter.comIP address #1: 23.51.65.224partners.twitter.comIP address #1: 199.59.148.243postmaster.twitter.comIP address #1: 199.59.148.144s.twitter.comIP address #1: 199.16.156.105IP address #2: 199.16.156.41IP address #3: 199.16.156.73sa.twitter.comIP address #1: 199.16.156.9IP address #2: 199.16.156.105IP address #3: 199.16.156.41IP address #4: 199.16.156.73search.twitter.comIP address #1: 199.16.156.105IP address #2: 199.16.156.41IP address #3: 199.16.156.73sms.twitter.comIP address #1: 199.59.148.95ss.twitter.comIP address #1: 199.59.148.84IP address #2: 199.59.149.243IP address #3: 199.59.150.42IP address #4: 199.59.150.10IP address #5: 199.59.148.11support.twitter.comIP address #1: 199.16.156.12td.twitter.comIP address #1: 199.59.148.21upload.twitter.comIP address #1: 199.59.148.213IP address #2: 199.59.148.148www.twitter.comIP address #1: 199.59.150.39IP address #2: 199.59.149.230IP address #3: 199.59.150.7www2.twitter.comIP address #1: 199.59.149.198[+] 33 (sub)domains and 65 IP address(es) found[+] regular-format results can be found on dnsmap_twitter.txt[+] completion time: 514 second(s) |
Existen diferentes herramientas para realizar este proceso, como dnsrecon, fierce, y hasta auxiliares en metasploit que nos facilitan la tarea, DNSmap es una herramienta más que puedes usar en este proceso y como pudiste apreciar en este texto su uso es muy sencillo, y poder obtener mucha información sobre un dominio en concreto. El correcto uso de una buena wordlist o diccionario de subdoinios nos ayudará en el proceso.
También te puede interesar – http://dragonjar.org/curso-gratuito-introduccion-al-pentesting-2.xhtml
