Exam 312-50v13 topic 1 question 145 discussion

Actual exam question from ECCouncil's 312-50v13

Question #: 145
Topic #: 1

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?

A. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
B. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
C. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std
D. dnsrecon -r 162.241.216.0/24 -d example.com -t brt

Show Suggested Answer

Suggested Answer: C 🗳️

by MHafizC at Jan. 15, 2025, 7:34 p.m.

Comments

Submit Cancel

NikoTomas

3 months, 2 weeks ago

Selected Answer: C

Answer: C Description of scan TYPES (-t option) from DNSRECON help: std: SOA, NS, A, AAAA, MX and SRV. brt: Brute force domains and hosts using a given dictionary. Further options: -n = name server (NS server) -d = domain -r = range of IP addresses to perform DNS reverse lookups on C) option contains “-n nsl.example.com” – i. e. NS server is already specified while the question asks to “determine the nameservers”, so it looks strange if we already have NS server determined in the answer. However, if we have one NS server defined, the command “-t std” can still find other NS servers (there are usually 2 or more) as well as MX records and other domain names as requested in question. I’ve tried this in Kali Linux for some domains and option “-t std” returned NS, MX and other records.

upvoted 1 times

NikoTomas

3 months, 2 weeks ago

Incorrect answers: D) option --> I’ve tried “-t brt” (i. e. bruteforce guessing common DNS names), which works also without specifying dictionary (-D parameter, uses built in default...). This finds MUCH MORE DNS records than “-t std” for particular domain but among them there were NO NS Server records and NO MX records found. So for me correct option is C) with “-t std”, which found NS and MX records. A) and B) contains private networks 192.168.x.x and 10.x.x.x – can’t be scanned by SecurityTrails tool over Internet. A) contains -t (type) axfr = perform zone transfer B) contains -t zonewalk = perform DNSSEC zone walk

upvoted 1 times

...

bibibi

4 months, 1 week ago

Selected Answer: C

the -t std is able to find out the requested information without the need of -t brt (brute force) enumeration.

upvoted 2 times

...

pindinga1

5 months ago

Selected Answer: C

✅ C. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std Explanation: The goal is to perform reverse DNS lookups, identify nameservers (NS), and find mail exchange (MX) records. The -r flag specifies an IP range for reverse DNS lookups. The -n flag specifies a nameserver to query. The -t std option performs standard enumeration, which includes: Reverse lookups on IP addresses (PTR records). Queries for MX records (Mail Exchange). Queries for NS records (Nameservers).

upvoted 3 times

...

MHafizC

5 months, 3 weeks ago

Selected Answer: C

This can be achieved with standard query, in which you will get NS, MX, PTR records. So C is the answer.

upvoted 1 times

...