dig

First of all, I should put a link the the dig manpage and a short example of its use:

dig +trace AAAA www.example.com

note that the equivalent in Microsoft world is nslookup but I know almost nothing about.

When requesting whoami.akamai.net, the answer depends on the host making the request (useful to detect DNS proxy). Try comparing multiple servers responses:

dig @8.8.8.8 A whoami.akami.net
dig @8.8.4.4 A whoami.akami.net

of course, more complicated stuff is possible:

#!/bin/sh
opt="+dnssec +trace"
outfile0=out0.txt
outfile1=out1.txt
rm -v $outfile0 $outfile1       #clean up
for rec in any a aaaa mx ns txt         # fetch some records
do
  dig $opt $rec $1
  sleep 1                               # we don't flood servers
done > $outfile0
while read fqdn ttl class type addr
do
  if [[$type=="A" -o $type=="AAAA"]]     # check ptr for addresses fetch
    then dig -x $opt $addr >> $outfile1
    sleep 1                             # we don't flood servers
  fi
done < $(grep -v -e '^;' -e '^.' $outfile0 | grep IN ) # remove comment line and root zone related RR, keep only line containing IN class RR

# show all results
cat $outfile0 $outfile1

dns_tree

Some people think (with reason) that dig is a low level tool and some front-end should be written to ease information retrieval. Here comes dns_tree and its debian packaging.

Nevertheless, this tool seems to work based on transfer zone (AXFR) that should not be allowed. Thus it seems to fail quite easily.

nmap

nmap comes with some DNS options.

• -R
• --version-all

Not quite useful, but still fun.

Misc

I found another script there.

(Non-)Related articles

• When attackers use your DNS to check for the sites you are visiting, (Mon, Nov 4th)
• Strange DNS Queries - Request for Packets, (Sat, Dec 21st)
• When Your Home Router is Working for the Bad Guys
• AD Zone Transfers as a user