# Performing DNS Zone Transfer & Viewing the Results w/ Aquatone

**URL:** <https://onehack.st/t/performing-dns-zone-transfer-viewing-the-results-w-aquatone/83143>\
**Category:** Tutorials & Methods\
**Tags:** tools\
**Created:** [April 28, 2020, 1:18pm UTC](https://onehack.st/t/performing-dns-zone-transfer-viewing-the-results-w-aquatone/83143 "2020-04-28T13:18:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [April 28, 2020, 1:18pm UTC](https://onehack.st/t/performing-dns-zone-transfer-viewing-the-results-w-aquatone/83143/1 "2020-04-28T13:18:33Z")

</div>

When you find that DNS is running on a box, you may want to check if it’s vulnerable to a DNS Zone Transfer. If it is, and you’re able to successfully perform the attack, it will return a list of all subdomains available on the server — making the enumeration process that much easier.

**Table of Contents:**

- Background
- Performing the DNS Zone Transfer Attack
- Formatting the Results
- Viewing the Results w/ Aquatone

In this guide, we will use the Hack The Box machine named FriendZone as an example. _Note: This document is not intended to be a walkthrough of the box._

## Background

At this point, we have already found the following information about the target machine.

- DNS is running on TCP Port 53.
- Machine located at 10.10.10.123.
- We’ve found two domain names already; _friendzoneportal.red_ & _friendzone.red_

## Performing the DNS Zone Transfer Attack

Let’s start by attempting a zone transfer on our first domain name with a tool called `dig` .

`sudo dig axfr @10.10.10.123 friendzoneportal.red`

 ![image](https://onehack.st/uploads/default/original/3X/8/a/8aaa9c70b9c7e4d103d9a6867abfeaa6c6797625.png)

Let’s check the other domain name too.

`sudo dig axfr @10.10.10.123 friendzone.red`

 ![image](https://onehack.st/uploads/default/original/3X/8/8/8874de8098993f7b402d21c6744a4ce8613ecb20.png)

Comparing the results of both, looks like each returns a different list of results. Let’s rerun each command, but add `>> zonetransfer` to the end of the commands so that we can create a new file called zonetransfer and append the results to it.

`sudo dig axfr @10.10.10.123 friendzone.red >> zonetransfer`  
`sudo dig axfr @10.10.10.123 friendzoneportal.red >> zonetransfer`

 ![image](https://onehack.st/uploads/default/original/3X/2/c/2c85b3b4b7e9ee6d9dfefa874453e5358eb2eb36.png)

## Formatting the Results

Let’s do some magic to strip out everything we don’t care about and output the results to a file named hosts.

`cat zonetransfer | grep friendzone | grep IN | awk '{print $1}' | sed 's/\.$//g' | sort -u > hosts`

 ![image](https://onehack.st/uploads/default/original/3X/d/0/d015b1eeb56b9c7790c9050cec73a2a0140c8fb7.png)

Nice! The goal is to place these domain names into our /etc/hosts file, which requires each host being separated by a space rather than a new line. Let’s use `vi` to perform a find & replace. Open the file by running `vi hosts` .

While in command mode, let’s run the following commands to find all new lines, replace them with a space. `:%s/\n/ /g`

 ![image](https://onehack.st/uploads/default/original/3X/f/5/f549ffbd73a3457ef3c1940a4a8d33ee40d43df1.png)

Press `Enter` to run the above command. Confirm your file looks like the screenshot below, and then run the following command to write the results to a new file named tmp. `:w tmp`

 ![image](https://onehack.st/uploads/default/original/3X/7/e/7e035aa36e2e17a318d32492f52882e6e6b891e6.png)

Run `:q!` to exit the file and then we can `cat` the contents of tmp to ensure things worked correctly.

![image](https://onehack.st/uploads/default/original/3X/f/0/f0b9bf8683a55ad2e861335671b018fb5f09ccde.png)

## Viewing the Results w/ Aquatone

Go ahead and copy out the contents of tmp. With those domain names in your clipboard, let’s update our /etc/hosts file.

`sudo vi /etc/hosts`

Add a new line to the file to include the hostnames at the IP address 10.10.10.123.

 ![image](https://onehack.st/uploads/default/original/3X/d/2/d2e5eebd1592bac7dd2266e67c28c820052ff8cf.png)

Now, we want to edit our list of hosts (not the /etc/hosts file) to append `http://` at the beginning of each line. There’s many ways to do this, but we’ll use a vi macro to speed up the process for us. Go ahead and run the command `vi hosts` to open the file in _command mode_ .

Press `qa` to start recording a macro. You should be able to see the footer change to _recording @a_ .

![image](https://onehack.st/uploads/default/original/3X/1/e/1e9f97a1375255f079a4140be41fe01cf49e7058.png)

We’ll still be in _command mode_ , so we want to press `i` to enter _insert mode_ .

Then, we can type `http://` to the first line. Press the `Down Arrow` key, and then press the `Home` key. If you do this correctly, you’ll be taken to the 2nd line where you want the http:// text to show up.

We’re done recording our macro, so press the `Esc` key to exit insert mode and go back to _command mode_ , and then press `q` to stop recording the macro. The footer showing _recording @a_ should no longer be present.

 ![image](https://onehack.st/uploads/default/original/3X/d/8/d847784141a91bb608cd81cba9dda3db6e2fadea.png)

With our macro recorded, let’s run it by pressing `@a` within _command mode_ .

 ![image](https://onehack.st/uploads/default/original/3X/4/f/4fa15dd4f2f2a14a196dd412384805cad6b76753.png)

So that ran it once, but we have seven additional lines to run it on. Let’s type `7@a` to run it seven times.

 ![image](https://onehack.st/uploads/default/original/3X/1/2/123faad603ab538b9334463e2f37ca380d4c2f63.png)

Nice! Now let’s run `:wq` to write our changes and quit, and then `cat` the file to review the results.

 ![image](https://onehack.st/uploads/default/original/3X/5/3/538a309b5c37ed7afee5b5a183bcb61d7b30f5b6.png)

Now we have a list of all the websites we want to view! Luckily there is a tool that can go out to each of these websites for us, let us know if the page is active, and even take a screenshot of it so we don’t have to open each one manually. This tool is called Aquatone, and you can find the precompiled binary from [GitHub](https://github.com/michenriksen/aquatone/releases/tag/v1.7.0).

One you have the binary download, extracted, and on your system, you may want to move it to `/bin` so that you can execute it from anywhere.

With Aquatone on our system, let’s make a new directory to store our loot, move our hosts file (containing our targets) into, change into it ourselves, and then run the tool.

`mkdir aquatone`  
`mv hosts aquatone/cd aquatone/cat hosts | aquatone`

 ![image](https://onehack.st/uploads/default/original/3X/f/1/f1f4d19c4e7c045321cec4c246543ba425eebaa7.jpeg)

The output of the command shows us which domains return pages, and which ones don’t — but the real beauty of this tool is in the generated html file. Let’s open up the report and see what we can find.

`firefox aquatone_report.html`

 ![image](https://onehack.st/uploads/default/original/3X/6/e/6ee42370c0218a404a6e336d0876daae4c3ad8b0.png)

Here we can easily see which pages are live and even get a sneak peak into what they’re running to know which ones we may be interested in.

_Source: infinitelogins_