TechKnowSurge
TechKnowSurge Catalog Videos DNS Reconnaissance
VideoSecurityFree

DNS Reconnaissance

DNS reconnaissance is a foundational step in target enumeration, using domain and IP address relationships to map an organization's infrastructure and identify potential attack surfaces. Tools like DNSdumpster, WHOIS, nslookup, and dig make it possible to extract significant intelligence with minimal effort.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DNS reconnaissance is a foundational phase of target enumeration that takes advantage of how the Domain Name System translates human-readable domain names into the IP addresses that route traffic across the internet. Because organizations must make DNS records publicly available to direct customers and partners to their services, those same records become a rich source of intelligence during a security assessment or offensive engagement. By querying the domains an organization owns, it is possible to identify A records, MX records, host entries, and other resource records that map directly to servers, services, and network infrastructure on the other side. Each DNS record can point to a distinct server or resource, and a single domain may have multiple records serving different purposes, such as load-balanced IP addresses for high-traffic services. Reverse DNS lookups extend this further by translating known IP addresses back into domain names, potentially revealing additional assets or related domains that share the same infrastructure. Any one of these discovered endpoints represents a potential entry point, and once the underlying equipment is identified, it can be researched for known vulnerabilities. This is where a fundamental security challenge becomes apparent: organizations must balance availability against security. Information that must be accessible to the public is equally accessible to a threat actor, and DNS is a clear example of that tension. DNS reconnaissance delivers substantial infrastructure intelligence with very little effort, which is why it appears early in any structured enumeration methodology. Commonly used tools for this phase include DNSdumpster, WHOIS, nslookup, and dig.

What you'll learn

What's covered

DNS Reconnaissance

Key terms

Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Enumeration
The process of extracting detailed information about a target, such as counting users, groups, and network resources, going deeper than general reconnaissance.
DNS Reconnaissance
The use of DNS queries and tools to map a target organization's domains, DNS records, and associated IP addresses during the information-gathering phase.
Reverse DNS Lookup
The process of resolving an IP address back to its associated domain name, used to discover additional resources tied to a known IP address.
DNS Record
An entry in a DNS database that maps a domain name to specific information such as an IP address (A record) or mail server (MX record).

Topics

Dns Reconnaissance Domain Enumeration Attack Surface Mapping Whois Nslookup Cybersecurity Penetration Testing

Transcript

One of the first things that we want to enumerate with a target is going to be the domains that they own. So when we're targeting an organization, let's do some DNS reconnaissance to find out what domains they own.

How DNS Works

DNS is domain name system. What essentially happens is that all of the traffic that we have routed on the internet gets routed through IP addresses. This is an example of an IP address. It's a private IP address, not a public one, but it's 192.168.5. That is an address that we would make a request to and say, "Hey, we want a website, we want a web page," or we want some sort of service — whatever the service is, it doesn't have to be web pages.

So what's happening is we're doing a request for a certain domain, and in this case right here, technj.com, and then for a specific host. So maybe it's the www host on the technj.com domain. That makes that request and then it gets translated to this IP address, so we can make the request to that website and say, hey, we want to see your web page.

Why Domains Matter to an Attacker

Essentially, when we are targeting a business or an organization, they're going to have a domain that they probably have purchased. This is what they're driving traffic to. This is what their customers are visiting. This is how we can find out more information about the company if we're interested in their services.

But since that domain is tied to an IP address, and that IP address is tied to a service or a server, now we've got equipment. So by targeting a company, we can easily find out what equipment is on the other side and what they're hosting by just doing a simple little research on this. And when we figure out what equipment it is, then we can start researching and figuring out what the vulnerabilities are of that equipment on the other side. In this case right here, it has a break in — maybe it's the firewall, or in this case it's a gate, or whatever the case may be. We can start researching vulnerabilities for that. That's what we can leverage. That's how we can get access to company resources. So that's what we're looking for.

What We Enumerate

So what are we doing during this discovery, or enumeration, or reconnaissance part of this? First of all, we need to discover what domains a company owns.

For each one of those domains, they could have many different resources. Here's an MX record. Here's an A record. Here's a host on that. Here's another, some sort of service that they're hosting through it. So we can find out a lot of records per each one of these domains.

For each one of these there could even be multiple records. In this case right here, maybe they're doing some sort of load balancing, so they've got 192.168.5.6 and 7 for load balancing purposes for their streaming services. Each one of these probably has some sort of different server or resources behind it that are hosting this. So any one of those could be our way to get into the company.

Reverse DNS

There are times when you can use reverse DNS as well. Reverse DNS is just the opposite — you take an IP address and you translate it to a domain. So maybe this is the information that we have, and then we do this reverse DNS to find out even more resources, or maybe it's other domains or other things that are tied to the same IP address.

DNS is a great start, which provides us a huge amount of value with very little effort.

Security Versus Availability

Here's where the real problem comes in to the target: there's this balance between security and availability. They want their services to be available to the outside world. They want certain information to be available to the outside world. But because they're making this available to the outside world, it's also available to an attacker. So we can leverage this now to reduce the amount of security that this company really has, because they've made this available to us. This is a balance that we as security professionals are trying to balance, between availability and security.

DNS Tools

Some examples of DNS tools would be DNSdumpster, whois, nslookup and dig. Those are just a few DNS tools that we could use for this reconnaissance.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →