Module -2

DNS Enumeration
 What is DNS Enumeration?

DNS enumeration is a method utilized to assemble data around a target domain's DNS framework. It includes
Domain Names Enumerating domain efficiently querying
names related DNS servers
Subdomains tosubdomains
extricatecan
data, such as
Identifying valuable
unveil
to the target organization, which can uncover their
additional entry focuses and administrations that may Mail Servers Finding mail servers and
online nearness and the structure of their
well be helpless to assaults.
administrations.

their configurations can lead to potential e-mail vulnerabilities or misconfigurations.

Name Server Records Revealing name server
MX Records Identifying Mail Exchange (MX) records Network Data Gathering IP addresses related to the
records can give experience into the domain's
can uncover the main framework, which assailants space can give a see into the organization's network
definitive DNS servers, which are dependable for
might abuse for phishing campaigns. layout.
overseeing its DNS data.
 The Essentials of
DNS
Some time recently plunging into
Within the evolving scene of
DNS enumeration, it's fundamental
When a client enters a domain title in cybersecurity, remaining ahead of
to get a handle on the basics of the
their browser, the DNS resolver potential dangers is basic. DNS
Domain Name System. DNS connects
queries the DNS servers to discover enumeration serves as an update on
user-friendly space names to the
the corresponding IP address. This the intricate interaction between
numerical IP addresses that
iterative handle includes numerous innovation and security. As
computers and servers get it. This
DNS servers working together to organizations tackle the control of
interpretation empowers clients to
supply the accurate IP address to the digital change, they must at the
get to websites and services without
resolver. same time brace their guards against
the got to keep in mind complex IP
advancing attack vectors.
addresses.
 The Essentials of DNS

By supporting a culture of
Besides, collaboration inside the
cybersecurity awareness,
cybersecurity community is
organizations can enable their
priceless. Sharing experiences, risk
groups to recognize the signs of
insights, and best-hones can help
enumeration attempts, phishing
organizations collectively build a
attacks, and other malevolent
stronger defense against DNS
activities. Customary preparation
enumeration and other cyber
sessions and instructive initiatives
dangers. Cybersecurity conferences,
can go a long way in preparing
online gatherings, and information-
workers with the information to
sharing stages give valuable
create informed choices when
avenues for this collaboration.
interacting online.
Inspirations Behind DNS Enumeration

Whereas DNS enumeration can be utilized for authentic

purposes like arranging examination and system administration,
it's moreover a tool in the arms stockpile of cyber aggressors.
Malicious actors utilize DNS enumeration to accumulate data for
different evil exercises, counting
• Brute Force Attacks  Attackers can utilize counted subdomains to conduct
brute constraint assaults on websites, endeavoring to recognize helpless
focuses of passage.
• Phishing  Uncovering mail servers and subdomains help in making
persuading phishing campaigns, driving casualties to malevolent websites.
• Social Engineering  Information on an organization's domain structure can
help assailants in carrying out social building assaults by creating personalized
and persuading messages.
• Targeted Misuses  Detailed data around an organization's network and
domain structure can offer assistance to aggressors distinguish particular
vulnerabilities to abuse.
Prevention and Relief
To neutralize the dangers related to DNS enumeration, organizations can
execute a few preventive measures
• Subdomain Enumeration Tools  Routinely perform subdomain
identification on your claim spaces to distinguish and secure potential section
focuses.
• Firewall Rules  Design firewall rules to limit unauthorized DNS questions
from outside sources.
• DNS Security Extensions (DNSSEC) Â Actualize DNSSEC to add an extra
layer of security by approving DNS reactions and anticipating cache-harming
assaults.
• Intrusion Detection Systems (IDS) Set up IDS to screen and distinguish
unordinary DNS exercises that might demonstrate count endeavors.
 Footprinting Methodology | Ethical Hacking
Footprinting Methodology
Various methods used to collect information about the target organization. They are
 Footprinting through Search Engines
This is a passive information gathering process where we gather information about the target
from social media, search engines, various websites etc. Information gathered includes
name, personal details, geographical location details, login pages, intranet portals etc. Even
some target specific information like Operating system details, IP details, Netblock
information, technologies behind web application etc can be gathered by searching through
search engines
Eg: collecting information from Google, Bingo etc
 Google Hacking:
Google hacking refers to collecting information using google dorks (keywords) by
constructing search queries which result in finding sensitive [Link] collected
include compromised passwords, default credentials, competitor information, information
 Footprinting Methodology | Ethical Hacking
Footprinting Methodology Cont.,
Various methods used to collect information about the target organization. They are
 Examining HTML Source and Examining Cookies:
Html source codes of a web application may give us an understanding of the application
functionality, hidden fields, comments, variable names etc. Cookies are used to identify a
user in his session. these cookies may be stored in the browser or passed in the URL, or in
the HTTP header.
The entire website can be mirrored using tools like HTTtracker to gather information at our
own phase. Extract website Archives: older versions of website can be obtained which may
reveal some information related to the target.
eg: [Link]
 Email Footprinting:
email header reveals information about the mail server, original sender’s email id, internal IP
addressing scheme, as well as the possible architecture of the target network
 Footprinting Methodology | Ethical Hacking
Footprinting Methodology Cont.,
Various methods used to collect information about the target organization. They are
 Competitive Intelligence
Competitive intelligence gathering is the process of gathering information about the
competitors from resources such as the Internet.
Eg: company website, search engine, internet, online databases, press releases,
annual reports, trade journals
 Google Hacking/Google Dorks
This is a process of creating search queries to extract hidden information by using Google
operators to search specific strings of text inside the search results.
Some google operators, site, allinurl, inurl, allintitle
 Footprinting Methodology | Ethical Hacking
Footprinting Methodology Cont.,
Various methods used to collect information about the target organization. They are
 Competitive Intelligence
Competitive intelligence gathering is the process of gathering information about the
competitors from resources such as the Internet.
Eg: company website, search engine, internet, online databases, press releases,
annual reports, trade journals
 Google Hacking/Google Dorks
This is a process of creating search queries to extract hidden information by using Google
operators to search specific strings of text inside the search results.
Some google operators, site, allinurl, inurl, allintitle
 Footprinting Methodology | Ethical Hacking
Footprinting Methodology Cont.,
 Footprinting through Social Engineering:
Social media like twitter, facebook are searched to collect information like personal details,
user credentials, other sensitive information using various social engineering techniques.
Some of the techniques include
• Eavesdropping: It is the process of intercepting unauthorized communication to gather
information
• Shoulder surfing: Secretly observing the target to gather sensitive information like
passwords, personal identification information, account information etc
• Dumpster Diving: This is a process of collecting sensitive information by looking into the
trash bin. Many of the documents are not shredded before disposing them into the trash
bin . Retrieving these documents from trash bin may reveal sensitive information
regarding contact information, financial information, tender information etc.
• Footprinting countermeasures:
o Creating awareness among the employees and users about the dangers of social
engineering
o Limiting the sensitive information
o encrypting sensitive information
o using privacy services on whois lookup database
o Disable directory listings in the web servers
 GOOGLE DORKING/HACKING

Google Dorking, also known as Google Hacking, is a technique that utilizes

advanced search operators to uncover information on the internet that may not
be readily available through standard search queries.

This strategy takes advantage of the features of Google’s search algorithms to

locate specific text strings within search results. Notably, while the term
“hacking” suggests an illicit activity, Google Dorking is entirely legal and often
used by security professionals to identify vulnerabilities in their systems.
Different Google Dorking Techniques: Google Dorking techniques primarily involve
using specific search operators. Below are some of the most commonly used methods:

• Filetype: This operator searches for specific file types. For example, `filetype:pdf`
would return PDF files.
• Inurl: The `inurl:` operator can be used to find specific words within the URL of a
page. For example, `inurl:login` would return pages with ‘login’ in the URL.
• Intext: With the `intext:` operator, you can search for specific text within the content of
a web page. For example, `intext:”password”` would yield pages that contain the word
“password”.
• Intitle: The `intitle:` operator is used to search for specific terms in the title of a
webpage. For example, `intitle:”index of”` could reveal web servers with directory
listing enabled.
• Link: The `link:` operator can be used to find pages that link to a specific URL. For
example, `link:[Link]` would find pages linking to [Link].
 ADVANTAGE EXPLANATION

1. Powerful Information Let users find very specific data (like PDFs,
Retrieval login pages, or hidden directories) quickly.

Ethical hackers use it to identify vulnerabilities

2. Cybersecurity Testing in websites (e.g., exposed databases or
misconfigurations).

Researchers, journalists, and investigators can

3. Research Efficiency use it to locate niche or hard-to-find
information.

Helps find publicly available datasets, academic

4. Data Discovery
papers, or government documents efficiently.

Requires only a web browser and Google — no

5. Free and Easy to Use
special tools or software.
 DISADVANTAGE EXPLANATION
Using Dorking to access sensitive or non-
1. Legal & Ethical Risks public data can violate privacy laws and
cybersecurity acts.
If misused, it can reveal personal data,
2. Exposure of Sensitive Data credentials, or internal files unintentionally
left online.
Cybercriminals use it to locate vulnerable
3. Misuse by Hackers
servers, admin panels, or confidential files.
Works only for data indexed by Google; not
4. Limited Scope effective for content behind paywalls or in
the Deep Web.
Excessive or suspicious searches may
5. Google Restrictions lead to temporary IP blocks or
CAPTCHA challenges.
What ?

OSINT is a methodology for gathering intelligence from open sources, which are
publicly accessible sources of information. These sources can include traditional
media (newspapers, magazines, TV, radio), publicly available data (government
reports, commercial databases, social media), and the internet (websites, forums,
blogs).

OSINT Principles, Tools and Techniques:

The core principle of OSINT is to collect and analyse data that is freely available to
the public, without resorting to covert or classified sources. This information can
come from a wide range of sources, including:
• News and media outlets
• Social media platforms (Twitter, Facebook, LinkedIn, etc.)
• Online forums and discussion boards
• Company websites and public filings
• Government databases and public records
• Academic publications and research papers
• Geospatial data and satellite imagery
• Publicly available videos and podcasts
 This intelligence can then be
used for various purposes, such
as:
• Cybersecurity and threat intelligence
Advantages of using OSINT • Competitive intelligence and business
analysis
• Law enforcement investigations
• National security and intelligence
gathering
• Risk assessment and due diligence
• Journalism and research
OSINT Framework
The OSINT framework is a comprehensive set of processes, techniques, and tools
designed to facilitate the collection, processing, analysis, and dissemination of
intelligence derived from publicly accessible sources. It encompasses a range of
data sources, including the internet, social media platforms, public records, news
reports, academic publications, and other open-source materials.
The Three Pillars of OSINT
[Link] Collection
1. Gathering information from publicly available sources such as:
[Link], social media, forums, blogs
[Link] databases, reports, publications
[Link] articles, academic journals, and media archives
2. Tools used: search engines (Google Dorking), social media analyzers, APIs, and web
scraping tools.
[Link] Analysis
1. Converting raw data into meaningful intelligence.
2. Analysts process, correlate, and interpret the data to identify:
[Link], relationships, and patterns
[Link] indicators and potential vulnerabilities
3. Techniques: link analysis, data visualization, natural language processing (NLP),
and machine learning.
[Link]
1. Delivering the intelligence insights to the right audience in a clear, actionable way.
2. Forms: reports, dashboards, alerts, or briefings.
3. The focus is on accuracy, relevance, and timeliness so that decision-makers
can act effectively.