Information Gathering using nslookup

NSLOOKUP: look up and find IP addresses in the DNS Query a DNS domain nameserver to lookup and find IP address information of computers in the internet. Convert a host or domain name into an IP address.

NSLOOKUP is a service to look up information in the DNS (Domain Name System ). The NSLOOKUP utility is a unix tool. Basically, DNS maps domain names to IP addresses.

Any answer that originates from the DNS Server which has the complete zone file information available for the domain is said to be authoritative answer.

In many cases, DNS servers will not have the complete zone file information available for a given domain. Instead, it maintains a cache file which has the results of all queries performed in the past for which it has gotten authoritative response. When a DNS query is given, it searches the cache file, and return the information available as “Non-Authoritative Answer”.

nslookup – Simple Example

C:\Windows\System32>nslookup www.google.com

Server:  UnKnown

Address:  192.168.0.1

Non-authoritative answer:

Name:    www.google.com

Addresses:  2404:6800:4003:803::2004          172.217.27.4

All other options available for nslookup

#nslookup 

Default Server:  UnKnown
Address:  192.168.0.1

>help

Commands:   (identifiers are shown in uppercase, [] means optional)
NAME            - print info about the host/domain NAME using default server
NAME1 NAME2     - as above, but use NAME2 as server
help or ?       - print info on common commands
set OPTION      - set an option
    all                 - print options, current server and host
    [no]debug           - print debugging information
    [no]d2              - print exhaustive debugging information
    [no]defname         - append domain name to each query
    [no]recurse         - ask for recursive answer to query
    [no]search          - use domain search list
    [no]vc              - always use a virtual circuit
    domain=NAME         - set default domain name to NAME
    srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
    root=NAME           - set root server to NAME
    retry=X             - set number of retries to X
    timeout=X           - set initial time-out interval to X seconds
    type=X              - set query type (ex. A,AAAA,A+AAAA,ANY,CNAME,MX,NS,PTR,
SOA,SRV)
    querytype=X         - same as type
    class=X             - set query class (ex. IN (Internet), ANY)
    [no]msxfr           - use MS fast zone transfer
    ixfrver=X           - current version to use in IXFR transfer request
server NAME     - set default server to NAME, using current default server
lserver NAME    - set default server to NAME, using initial server
root            - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
    -a          -  list canonical names and aliases
    -d          -  list all records
    -t TYPE     -  list records of the given RFC record type (ex. A,CNAME,MX,NS,
PTR etc.)
view FILE           - sort an 'ls' output file and view it with pg
exit            - exit the program

a--an IP address

any--any and all available data

cname--canonical name

gid--a group identifier for a group name

hinfo--CPU and type of operating system

mb--mailbox domain name

mg--mail group member

minfo--mailbox or mail list information

mr--mail rename domain name

mx--mail exchanger

ns--the name servers for the named zone

ptr--if the query is an IP address, returns a server name; otherwise, a pointer to other information

soat--he start of authority for the named zone

txt--returns a textual string with relevant information