Learn / Networking Fundamentals / Names and Services

Names and DNS

guidedeasy 30 min · 95 points

First Bit is still up for grabs: be the first to finish this room.

Machines talk using addresses, but people use names. DNS, the Domain Name System, is the internet's phone book: it turns www.example.com into an address your computer can connect to. Almost every connection you make starts with a DNS lookup, which also makes DNS a rich source of information for defenders and investigators.

In this room you'll learn what DNS stores and how to query it by hand, then explore a small company zone, corp.lab, on a live machine.

CYB//RANGE Live lab

Task 1 What DNS does

When you visit a website, your machine asks a DNS resolver "what's the address for this name?". The resolver finds the answer, remembers it for a while, and replies. The machine then connects to that address.

DNS stores several kinds of records for each name:

Record	Holds	Example
`A`	an IPv4 address	`www.corp.lab → 10.66.0.20`
`AAAA`	an IPv6 address
`MX`	the mail server(s) for a domain	`corp.lab → mail.corp.lab`
`CNAME`	"this name is an alias for that one"	`shop → www`
`TXT`	free text: ownership checks, email security settings, notes

DNS queries normally travel over port 53. Which resolver a Linux machine asks is listed in /etc/resolv.conf.

Which DNS record type holds a name's IPv4 address? (One letter.)

*

Which record type names the mail server for a domain?

**

Which port number does DNS use?

**

Task 2 Asking DNS yourself

dig asks DNS directly and shows you the answer:

$ dig www.example.com
;; ANSWER SECTION:
www.example.com.   3600  IN  A  93.184.215.14

Ask for a specific record type by putting it before the name, and add +short to get just the answer:

$ dig +short A www.example.com
93.184.215.14
$ dig +short MX example.com
10 mail.example.com.

(The number in the MX answer is its priority: lower is tried first.)

DNS isn't the only way a name gets an address. The file /etc/hosts lets one machine hard-code names for itself, and it's checked before DNS. dig only ever asks DNS, so a name that lives only in /etc/hosts is invisible to it. To see what the system as a whole would use, run getent hosts NAME.

What do you add to a dig command to print just the answer?

******

Which file lets a single machine map names to addresses without asking DNS at all? (Full path.)

/***/*****

Task 3 Try it on a real machine

The lab machine runs a small DNS server for the corp.lab zone, and it's the machine's own resolver, so plain dig asks it.

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as ivan.
Check which resolver the machine uses: cat /etc/resolv.conf.
Look names up: dig +short www.corp.lab, dig +short MX corp.lab, dig +short TXT corp.lab.
Try dig backup.corp.lab, then getent hosts backup. Why do they disagree?

What address does www.corp.lab resolve to?

**.**.*.**

Which host is the mail server for corp.lab?

dig backup.corp.lab finds nothing, yet ping backup knows its address. What address is it?

**.**.*.**

flag.corp.lab has a TXT record. What does it say (without the quotes)?

RZ{************************}