Module 10. (Reconnaissance Whois and DNS)

Transcription

1 (Reconnaissance Whois and DNS) At the end of this module, you should what Domain Names and IPv4 Address are and how they are related by the Domain Name Service. You should also have an idea of what kind of information you can find out from whois records associated with domains. 1/13

2 Internet Organizations Internet Corporation for Assigned Names and Numbers (icann.org) and IANA (Internet Assigned Numbers Authority) coordinate the assignment of Internet domain names (human readable names that identify groups of machines) IP address numbers (numbers used to route internet messages to the correct host) ICANN delegates its work to Address Supporting Organizations (ASOs) ASOs allocate IP address blocks to Regional Internet Registries (RIRs). APNIC (apnic.net) Asia-Pacific Region ARIN (arin.net) North and South Americ, Sub-Sahara Africa LACNIC (lacnic.net) Parts of Latin America and the Caribbean RIPE (ripe.net) Europe, some of Asia, Africa north of the equator, Middle East AfriNIC (afrinic.net Eventually all of Africa) 2/13

3 IPv4 Addresses Octet (number in range 0-255) So-called because it is represented with 8 bits (one byte) IPv4 Addresses are comprised of 4 octets , , As originally envisioned, the internet would be assigned in network chunks of different sizes according to class: Class A networks: first octet starts with 0, network address is one octet three octets for host addresses (128 networks, 16,777,216 addresses) Class B networks: first octet starts with 10, network address is two octets (16,384 networks, 65,536 addresses) Class C networks: first octet starts with 110, network address is three octets (2,097,152 networks, 256 addresses). 3/13

4 Host/Domain Names Sequence of labels terminated by dots. The rightmost dot is implied if missing. The labels are strings of upper and/or lower case characters (A-Za-z), numbers, or hypens. Examples thunder.cise.ufl.edu. whitehouse.gov sit.sploitlab.com?!?!?! 4/13

5 CIDR = Classless Inter-Domain Routing When scalability of the class-based network assignment became a problem, people started using Classless routing, in which the number of bits in the network address is variable (1-32 bits for network address, 31-0 bits for host address). One can denote such a network address using a notation like a.b.c.d/n where n is the number of bits in the network address /22 contains hosts to Actually is the network address and is the broadcast address, so only 2^(32-22) - 2 = 2^10-2 = 1022 host addresses are usable The netmask has 1s in every bit of the network address and 0s in the host bits. Thus, for /22 the netmask is (252 = 0b = ) 5/13

6 How Does DNS Map Names to Numbers? DNS = Domain Name Service System Server Hierarchical Database The root domain is the empty domain name (ε or λ) Root Name servers know the IP addresses of all Top Level Domain (TLD) name servers like edu, com, etc. These servers in turn know the IP addresses of their subdomains. (edu knows the address of the ufl.edu server). And so forth (the ufl.edu nameserver knows the address of the cise.ufl.edu name server) 6/13

7 How Does DNS Map Numbers to Names? With the in-addr.arpa domain. To find the name of an address like , you need to do a DNS lookup on in-addr.arpa This address has its octets reversed so the most general network part comes rightmost. The hierarchical lookup starts (theoretically) at the in-addr.arpa server Some name servers will cache results, others will not. Some DNS servers are recursive (they will carry out a queury for you by contacting all the other nameservers. Others will forward your to the appropriate name server for a better answer. 7/13

8 Why Worry About DNS and IP Addresses? If you don't understand the relationship between domain names and IP addresses, you are not going to go far in a penetration test. Clients will often provide partial information about their domains (for example, only externally visible resources). You will need to be able to understand the structure of their entire network in order to do your job fully. 8/13

9 Whois Servers Provide Registrant Information Navigate to Provide a domain name If complete information is not available, you will be directed to another whois server with more complete information. Navigate to the next whois server. Get information. Example shows finding out about secureideas.com Alternatively, after finding correct whois server, issue this command at your linux host: whois -h whois_server domain_name 9/13

10 10/13

11 11/13

12 12/13

13 13/13