DNS Enumeration

    The main usage is

    1. require 'net/dns'
    2. resolver = Net::DNS::Resolver.start("google.com")

    Returns

    1. ;; Answer received from 127.0.1.1:53 (260 bytes)
    2. ;;
    3. ;; HEADER SECTION
    4. ;; id = 36568
    5. ;; qr = 1       opCode: QUERY   aa = 0  tc = 0  rd = 1
    6. ;; ra = 1       ad = 0  cd = 0  rcode = NoError
    7. ;; qdCount = 1  anCount = 6     nsCount = 4     arCount = 4
    9. ;; QUESTION SECTION (1 record):
    10. ;; google.com.                  IN      A
    12. ;; ANSWER SECTION (6 records):
    13. google.com.             31      IN      A       64.233.183.102
    14. google.com.             31      IN      A       64.233.183.113
    15. google.com.             31      IN      A       64.233.183.100
    16. google.com.             31      IN      A       64.233.183.139
    17. google.com.             31      IN      A       64.233.183.138
    20. google.com.             152198  IN      NS      ns1.google.com.
    21. google.com.             152198  IN      NS      ns3.google.com.
    22. google.com.             152198  IN      NS      ns4.google.com.
    23. google.com.             152198  IN      NS      ns2.google.com.
    25. ;; ADDITIONAL SECTION (4 records):
    26. ns3.google.com.         152198  IN      A       216.239.36.10
    27. ns4.google.com.         152198  IN      A       216.239.38.10
    28. ns2.google.com.         152198  IN      A       216.239.34.10
    29. ns1.google.com.         345090  IN      A       216.239.32.10

    As you can see from response above, there are 5 sections

    • Header section: DNS lookup headers
    • Question section: DNS question,
    • Answer section: Array of the exact lookup answer (base on lookup type. ex. A, NS, MX , etc)
    • Authority section: Array of authority nameserver
    • Additional section: Array array of nameserver lookup
    1. resolver.header
    2. resolver.question
    3. resolver.answer
    4. resolver.authority
    5. resolver.additional

    A record

    Because the A record is the default, we can do like above example

    or in one line to get exact answer.

    1. resolver = Net::DNS::Resolver.start("google.com").answer

    will return an array with all IPs assigned to this domain

    1.  google.com.             34      IN      A       74.125.239.39,
    2.  google.com.             34      IN      A       74.125.239.33,
    3.  google.com.             34      IN      A       74.125.239.34,
    5.  google.com.             34      IN      A       74.125.239.32,
    6.  google.com.             34      IN      A       74.125.239.46,
    7.  google.com.             34      IN      A       74.125.239.40,
    8.  google.com.             34      IN      A       74.125.239.38,
    9.  google.com.             34      IN      A       74.125.239.37,
    10.  google.com.             34      IN      A       74.125.239.41]
    1. mx = Net::DNS::Resolver.start("google.com", Net::DNS::MX).answer
    1. [google.com.             212     IN      MX      40 alt3.aspmx.l.google.com.,
    2.  google.com.             212     IN      MX      30 alt2.aspmx.l.google.com.,
    3.  google.com.             212     IN      MX      20 alt1.aspmx.l.google.com.,
    4.  google.com.             212     IN      MX      50 alt4.aspmx.l.google.com.,
    5.  google.com.             212     IN      MX      10 aspmx.l.google.com.]

    returns

    1. [facebook.com.           385     IN      A       173.252.120.6,
    2.  facebook.com.           85364   IN      TXT     ,
    3.  facebook.com.           149133  IN      NS      b.ns.facebook.com.,
    4.  facebook.com.           149133  IN      NS      a.ns.facebook.com.]

    for list of types, please refer to the 

    1. resolver = Net::DNS::Resolver.new
    2. query = resolver.query("69.171.239.12", Net::DNS::PTR)

    If you want to specify the nameserver(s) to use, it support an array of nameserver

    1. resolver = Net::DNS::Resolver.new(:nameserver => "8.8.8.8")
    1. resolver = Net::DNS::Resolver.new

    http://searchsignals.com/tutorials/reverse-dns-lookup/