[Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning

[Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: [Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning (/showthread.php?tid=4569209)

[Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning - ℜuby - Dec 6, 2014

If you want to use DNS as your attack vector, you will have to scan for DNS amplification lists. DNS scanners require a domain as that is the best way to obtain high byte sized replies. Although, you don't need to use a domain with other dns scanning tools.

You can use your own domain name, but they get suspended quickly by the domain registrar. It's also a pain in the ass to setup the server so you can query through it to find your recursive DNS servers.

Why not just "steal" other people's domains?

Code 
sudo apt-get update

Update your stuff.

Code 
sudo apt-get install bind9

Install bind.

Code 
sudo nano /etc/bind/named.conf.options

Open up the bind config.

Code 
auth-nxdomain no; //doesn't matter, don't touch this

listen-on-v6 { ::1; }; //ipv6 doesn't matter, don't touch this

listen-on { 127.0.0.1; }; //**replace this with your sever's IP address**

recursion no; //you don't want this on

Edit these things. Ctrl + X, save, and exit.

Code 
sudo service bind9 restart

Restart bind for config edits to take effect.

Code 
sudo rndc querylog

Turns on query logs. *Note* if you restart your server you will have to retype this.

Code 
sudo nano /var/log/syslog

This where the query logs are kept by default. You're looking for something like this:

[Image: s1wCtq5.png]

*Note* You may have to leave the honeypot running for days, or even a week, to find a domain. People aren't scanning for recursive DNS servers as much these days.

The orange boxes are around the domain this DNS scanner was using. Now you can use their domain to query through with your DNS scanner instead of having to use your own domain+server to query through.

* - R҉eece҉ - Dec 6, 2014

Great tutorial. Going to set this up on my $5 VPS to make DNS lists 4 DAYZ!

* - Chegu - Dec 7, 2014

Nice tutorial, i cant seem to find install command on CentOS though :/

* - z0tpyrk - Dec 7, 2014

(Dec 7, 2014 08:53 AM)Chegu Wrote: Nice tutorial, i cant seem to find install command on CentOS though :/

Use google:

https://www.google.nl/search?q=CentOS&oq=CentOS&aqs=chrome..69i57&sourceid=chrome&es_sm=93&ie=UTF-8#q=CentOS+instal+command+line

* - ℜuby - Dec 7, 2014

(Dec 7, 2014 08:53 AM)Chegu Wrote: Nice tutorial, i cant seem to find install command on CentOS though :/

I'm not really sure what you mean?

CentOS uses yum install instead of apt-get install.

RE: [Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning - Cookiesa - Jan 26, 2020

Great tutorial！！！！Great tutorial

RE: [Tutorial] DNS Honeypot -- Find Domains For DNS List Scanning - Young Sosa - Jan 27, 2020

(Jan 26, 2020 10:29 AM)Cookiesa Wrote: Great tutorial！！！！Great tutorial

You can’t see it’s a post made in 2014? 😶