DNS reconnaissance

DNS reconnaissance is a common technique used by ethical hackers and threat actors to collect information about a target by gathering publicly available information from DNS servers on the internet. If you recall, DNS is a network protocol that allows a system to resolve a hostname to an IP address, and there are many DNS servers on the internet that contain public DNS records about various registered domain names.

As an ethical hacker, DNS reconnaissance focuses on sending DNS queries to either the target-owned DNS server or a public DNS server to retrieve DNS records about the target’s domain name, IP addresses, and sub-domains. The collected responses are analyzed to identify any valuable information about the target such as their systems and network architecture, potential security vulnerabilities, and application platforms.

In this section, you will learn how to use various tools and techniques to efficiently collect and analyze DNS information...