Now the second tool I want to point out, which is kind of following up on one
of the methods we used to search while ago, is a DNS recon.
And again, I'm going to have this below as far as the syntax is concerned, but
this follows up the search that we did on the who is domain lookup.
And you may get more information from DNS recon than you do on the actual who
is the stuff.
So as an example, I just want to pull up, go ahead and type in pseudo DNS recon
dash D for our domain and CBT nuggets.com.
And we're going to use it and bounce it off the name server of 8888 because we
can specifically identify the name server that we want to use.
Now, when I go ahead and hit this, it's going to go through and give us
basically all the DNS records we would see inside of a DNS server.
Let me pause here for a second to man for you. For instance, a name server, a
state of authority. And if I pop out again real quick, we see that we actually
have some host records here, a records and other text information for the
domain itself.
Now that was against the actual name server itself, but I want to apply this to
something we just learned about earlier using who is.
While ago, when we did the who is look up for hybrid school of wrestling.com,
we came across this and we didn't find anything else other than the fact that
it was behind a third party service like GoDaddy.
I bring this up specifically because right here.
And we pop out and zoom in for you real quick. We actually have name servers
that we can apply to our actual tool inside of Cali pop out here for a second.
And if we go down, we can see that the actual name servers are listed in the
text printout. And that's kind of what we want to do in terms of being able to
run our DNS recon for hybrid school of wrestling.
So if we do this, we'll say pseudo DNS recon. Against the domain of hybrid
school of wrestling.com.
And I want to make sure that we use a dash in and point this to ns45.domain
control.com, which was the actual DNS name server.
One of two assigned to the actual who is records that we got earlier.
So when we run this, we can see that we're starting to get some more
information as to what's actually going on for hybrid school of wrestling
website.
For instance, if I scroll up and then move first, let me zoom in and show you
what I'm talking about.
I can go ahead and highlight those real quick and show you that there are two
whoops records that popped up for the domain with IP addresses.
Along with some other DNS stuff for the actual website itself.
And if I move this back over here, you can see that one of those may have
popped up. Did they?
Right here, 3.33, 2.51, 168 did pop up, but there's discrepancy here because
there's only one IP address on this listing.
But there's a second IP address right here.
So that's more detailed information than we got from our who is and that's
where we start to use tools like DNS recon and others from Cali.