Host

How to Use the host Command for DNS Lookup

The host command is a simple utility for performing DNS lookups in UNIX-like operating systems. It is used to find the IP address of a domain, as well as DNS records, such as NS, MX, TXT, CNAME, and A records. Here's how to use the host command with different options:

1. Finding Name Servers (NS) of a Domain

host -t ns domain.com

Explanation: This command retrieves the Name Servers (NS) for the domain domain.com. NS records specify the DNS servers responsible for the domain.

2. Enumerating Hostnames

host -l domain.com ns53.domaincontrol.com

Explanation: This command attempts to list all hostnames in the domain.com domain using a zone transfer. The zone transfer is requested from the DNS server ns53.domaincontrol.com.

3. Finding Mail Servers (MX) of a Domain

host -t mx domain.com

Explanation: This command retrieves the Mail Exchange (MX) records for the domain domain.com. MX records specify the mail servers responsible for accepting email messages on behalf of a domain.

4. Finding Text (TXT) Records of a Domain

host -t txt domain.com

Explanation: This command retrieves the Text (TXT) records for the domain domain.com. TXT records can hold arbitrary text and can be used for various purposes, including verifying domain ownership and configuring email spam filters.

5. Finding Canonical Name (CNAME) Records of a Domain

host -t cname domain.com

Explanation: This command retrieves the Canonical Name (CNAME) records for the domain domain.com. CNAME records are used to alias one name to another.

6. Finding IP Address (A Records) of a Domain

host -t A domain.com

Explanation: This command retrieves the IP Address (A Records) for the domain domain.com. A records map a domain to an IPv4 address.

7. Reverse DNS Lookup

host -l 10.10.10.10

Explanation: This command performs a reverse DNS lookup to find the hostname associated with the IP address 10.10.10.10. It can provide information about the organization or entity that owns the IP range.

DNS and Subdomain Enumeration Bash Script

This bash script is designed to automate the process of DNS lookup and subdomain enumeration for a given domain.

Script Code

#automate - lookup dns then use them to query thier subs
# Usage: ./script.sh domain.com
#!/bin/bash
if [ -z "$1" ]
then
	echo "./script.sh domain.com"
	exit 0
fi
for ns in $(host -t ns $1|cut -d" " -f4)
do
	host -l $1 $ns|grep "has address"
done