BACKTRACK 5 R3 : DNSDICT6

1.    I have been using and playing with BT5 R3 for quiet some time now...and having used and practised about 50% of them...I have decided to start sharing and how to use them on my blog for the firstimers..with screen shots and screen cast when required....although I have shown few tools and exploits of BT5 earlier .... now I wish to just make it all systematic....and in the first attempt here I am giving out a step by step screen shot of how to use the tool DNSDICT6...

2. The route to dnsdict6 is show in the screen shot below :

Backtrack - Information Gathering - Network Analysis - DNS Analysis - dnsdict6

3.  As can be made out from the Backtrack menu drop down...since it is listed in the information gathering sub menu..it is a Information Gathering tool. This tool is used to find all the sub-domains of a website or web server. The most advanced use of DSNDICT6 is to enumerate all IPv4 and IPv6 addresses and extract the dumps like sub-domains, IP information. This tool is quite a powerful tool because it also extracts those sub domains which are restricted or invisible for users.With respect to the usage and screens...they are seen below :

(Click on the image to Enlarge)

Once you click this dnsdict6...u get the following screen :

(Click on the image to Enlarge)

Before we execute the command,let us see the command syntax & switches available :

The switches details are seen below :

    - d is used to display information on Name Servers and MX Records
    - 4 is used to dump IPv4 addresses.

Four types of dictionary are inbuilt in this tool as follows :

     - s    (mall=50), 

     - m   (edium=796) (DEFAULT) 

     - l     (arge=1416), and

     - x    (treme=3211).
     - t      is used to specify no. of threads.

MX record ie mail exchanger record is a type of resource record in the Domain Name System that specifies a mail server responsible for accepting email messages on behalf of a recipient's domain, and a preference value used to prioritize mail delivery if multiple mail servers are available. The set of MX records of a domain name specifies how email should be routed with the Simple Mail Transfer Protocol (SMTP).

So for example we run this command on http://certifiedhacker.com/

(Click on the image to Enlarge)

The command reads :

dnsdict6 -d46 -s -t 10 certifiedhacker.com

(Click on the image to Enlarge)

In the command above I have used the small dictionary with 10 threads to minimize the running time...so actually this is a limited result...would have been slightly different had the same been run with xtreme dict and large number of threads...