Dec 6, 2014 01:20 AM
(This post was last modified: Dec 15, 2014 03:46 PM by ℜuby.)
If you want to use DNS as your attack vector, you will have to scan for DNS amplification lists. DNS scanners require a domain as that is the best way to obtain high byte sized replies. Although, you don't need to use a domain with other dns scanning tools.
You can use your own domain name, but they get suspended quickly by the domain registrar. It's also a pain in the ass to setup the server so you can query through it to find your recursive DNS servers.
Why not just "steal" other people's domains?
Update your stuff.
Install bind.
Open up the bind config.
Edit these things. Ctrl + X, save, and exit.
Restart bind for config edits to take effect.
Turns on query logs. *Note* if you restart your server you will have to retype this.
This where the query logs are kept by default. You're looking for something like this:
![[Image: s1wCtq5.png]](https://i.imgur.com/s1wCtq5.png)
*Note* You may have to leave the honeypot running for days, or even a week, to find a domain. People aren't scanning for recursive DNS servers as much these days.
The orange boxes are around the domain this DNS scanner was using. Now you can use their domain to query through with your DNS scanner instead of having to use your own domain+server to query through.
You can use your own domain name, but they get suspended quickly by the domain registrar. It's also a pain in the ass to setup the server so you can query through it to find your recursive DNS servers.
Why not just "steal" other people's domains?
Code
sudo apt-get updateUpdate your stuff.
Code
sudo apt-get install bind9Install bind.
Code
sudo nano /etc/bind/named.conf.optionsOpen up the bind config.
Code
auth-nxdomain no; //doesn't matter, don't touch this
listen-on-v6 { ::1; }; //ipv6 doesn't matter, don't touch this
listen-on { 127.0.0.1; }; //**replace this with your sever's IP address**
recursion no; //you don't want this onEdit these things. Ctrl + X, save, and exit.
Code
sudo service bind9 restartRestart bind for config edits to take effect.
Code
sudo rndc querylogTurns on query logs. *Note* if you restart your server you will have to retype this.
Code
sudo nano /var/log/syslogThis where the query logs are kept by default. You're looking for something like this:
![[Image: s1wCtq5.png]](https://i.imgur.com/s1wCtq5.png)
*Note* You may have to leave the honeypot running for days, or even a week, to find a domain. People aren't scanning for recursive DNS servers as much these days.
The orange boxes are around the domain this DNS scanner was using. Now you can use their domain to query through with your DNS scanner instead of having to use your own domain+server to query through.
![[Image: Dl25VbV.gif]](https://i.imgur.com/Dl25VbV.gif)




![[Image: rMzGJ4n.png]](https://i.imgur.com/rMzGJ4n.png)