Stuck on the Network Reconnaissance Lab

General
1

I was solving the challenge LAB in Network Reconnaissance and have solved the previous 2 questions but I am stuck on question 3. I tried all the options but I am not getting the domain.

# Task 3

You’ll also discover one of these hosts is a DNS server running the BIND software. That’s handy since your IPs don’t seem to be resolving to any domains. This internal DNS server might be able to help you in this last sequence.

Hint: The --dns-server option specifies the nameserver Nmap should use for reverse resolution.

Use Nmap to perform a list scan to resolve your targets using the discovered DNS server for resolution. You’ll find a web server with an interesting domain name here

2

In the task 3 :
– perform the nmap scan to find the ip address of the dns server using 192.168.0.0/23 .

It will out put a list of ip running .

In side, find the dns server has service named BIND,
sudo nmap -sL --dns-server -iL iplist.lst

then you do rDNS using -n . find the name of the nameserver as it starts with hint. stag*

run sudo nmap -p 80,443 --script http-enum
replace with staging.*** domain

you get the output,

there will be a file displayed …

5:4 letters

1 Like