Active Information Gathering

Unlike passive recon which pulls information from third parties without ever touching the target active information gathering means interacting directly with the target's systems: querying its DNS servers, sending packets to its hosts, scanning its ports. That interaction can be logged, rate limited, or flagged by the target's own monitoring, which is exactly why authorization matters here more than anywhere else in the recon phase.

DNS Fundamentals

DNS (Domain Name System) is the protocol that resolves domain names or hostnames to IP addresses.

A nameserver stores domain names and their corresponding IP addresses, and answers queries for them.

Examples of public DNS servers:

• Cloudflare — 1.1.1.1
• Google — 8.8.8.8

DNS Record Types

DNS interrogation is the process of actively enumerating these records for a target domain it can surface IP addresses, subdomains, and mail server addresses that passive recon might miss.

DNS Zone Transfers

Threat Model

A zone transfer (AXFR) is meant to let a DNS administrator replicate zone files from a primary server to an authorized secondary server. If a nameserver doesn't restrict who can request that transfer, anyone can ask for it and receive a complete dump of every record in the zone in a single query. That's every subdomain, internal hostname, and mail server the organization has, handed over at once, no guessing required.

Method

ZoneTransfer.me is a domain deliberately configured to allow zone transfers, built for exactly this kind of practice authorization is explicit and built into the exercise.

Enumerate DNS records:

dnsenum --help
dnsenum zonetransfer.me

Attempt a zone transfer directly with dig:

dig axfr @nsztm1.digi.ninja zonetransfer.me

Point local resolution at a specific host (useful for testing against an internal name before DNS has propagated, e.g. a router's admin interface):

sudo nano /etc/hosts
# add a line:
192.168.1.1 router.admin

Defensive Takeaway

Run dig axfr against your own domain from an external host. If it returns a full zone instead of a refusal, that's a critical misconfiguration AXFR should be restricted to explicitly authorized secondary nameservers only.

Host Discovery with Nmap

Before an attacker can target anything, they need to know what's actually alive on the network. Host discovery sweeps a range to build that list the first concrete map of a network from the inside.

Method

Find your own IP first:

ip a s

Nmap network exploration tool and security/port scanner. A ping-style sweep (-sn) skips port scanning and just checks which hosts respond:

sudo nmap -sn <your_local_ip_range>

netdiscover an alternative built specifically for discovering live devices on a local network:

netdiscover -i eth0 -r 192.168.2.0/24

Host discovery sweeps generate a burst of ICMP/ARP traffic that's distinctive on a network. This is exactly the kind of activity a SIEM should catch if you're running the Wazuh lab, this is worth simulating and writing a detection rule for.

Port Scanning with Nmap

Once hosts are known, port scanning identifies which services are listening and what software/version is behind them the step that turns "this host is alive" into "this host might be exploitable."

Method

Default scan a SYN scan of the most common ports:

nmap <ip_target>

Bypass host discovery when you already know the target is live:

nmap -Pn <ip_target>

A more thorough pass — fast scan, version detection, OS detection, default scripts:

nmap -F -sV -O -sC <ip_target> -v

Export results for documentation:

nmap -Pn -F <ip_target> -oN test.txt

Port scans against your own infrastructure should be a standard part of your hardening checklist: anything reachable that you didn't expect to be exposed is a finding on its own, independent of whatever service version it's running.

References

• ZoneTransfer.me
• Nmap documentation