Project 17: DNS Enumeration

Module: Module 2: OSINT, Social-Engineering Awareness & Traffic Analysis  |  Level: Beginner  | 
Primary tool: dnsenum / dig  |  Estimated time: 45–75 minutes

Objective: Map a domain’s DNS footprint to understand what infrastructure it reveals.

Free lab environment

scanme.nmap.org + TryHackMe (free tier) — https://scanme.nmap.org/ and https://tryhackme.com/room/introtonetworking

scanme.nmap.org is the Nmap Project’s own public host, explicitly maintained for learners to scan legally, so long as you scan lightly and do not run intrusive options like heavy vulnerability scripts or denial-of-service tests against it. For anything more thorough, create a free TryHackMe account and deploy the room’s disposable target machine instead.

Lab workflow

1. Write a one-paragraph scope note: your target is a domain you own, or scanme.nmap.org, your tool is dnsenum / dig, and your goal is to map a domain’s DNS footprint to understand what infrastructure it reveals.
2. Confirm authorization: re-read the lab platform’s terms and this project’s Safety section before sending a single packet.
3. Run your baseline dnsenum / dig command against the target and save the raw output to a text file before you interpret anything.
4. Interpret the output: for every result, write one sentence on what it tells a defender, not just what it tells an attacker.
5. Re-run the same command a second time and compare results — note anything that changed, since real infrastructure is not static.
6. Package your findings into the report format described under Expected Deliverable below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• terminal output of your `dig`/`dnsenum` enumeration
• your written note on one DNS record type that, if misconfigured, is a common real-world risk (e.g. an open zone transfer)

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.