DNS talks
DNS is the company's phone book, and every name is a clue. You have a list of names to try (wordlist.txt) for the corp.nr domain: find out which ones exist and reach the one nobody remembers.
Lab 4 of 6 in the Recon & Scanning path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 150 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the wordlist of names to try (50 XP)
- Try a name that does not exist (NXDOMAIN) (100 XP)
- Discover the forgotten subdomain (150 XP)
- Open the test environment page (150 XP)
Topics: recon, dns, dig.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.dig: queries DNS and tells you which address a name points to; if the name does not exist it answers NXDOMAIN.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Every name in DNS is a clue for an attacker: subdomain names (staging, dev, vpn) reveal environments, technologies and offices, and a forgotten test environment is often poorly protected yet holds real data. Defense: keep internal DNS separate from public DNS (split-horizon: internal names must not be answerable from outside), delete records that are no longer needed, put test environments behind a VPN or authentication with fake data, and compare the DNS records against the asset inventory from time to time.
Before and after this lab
To unlock it you must have solved:
- Who's on the network? (Recon & Scanning, medium)
After this lab you can move on to:
- Full reconnaissance (Recon & Scanning, hard)
The Recon & Scanning path
Recon & Scanning is reconnaissance: before defending a network, or testing it with permission, you need to know what is in it. You learn to discover live hosts, list ports and services, read the banners services greet you with, and query DNS and HTTP headers. Every lab also shows the defender’s point of view: an up-to-date asset inventory, minimal banners, internal DNS kept apart from public DNS and nothing forgotten left running.