Skip to content
HackIndex logo

HackIndex

DNS Misconfiguration Probing

1 min read May 15, 2026

Quick checks reveal exploitable behaviors like open recursion or wildcards.

Recursion Check

┌──(kali㉿kali)-[~]
└─$ dig google.com @$TARGET_IP +short

Resolution indicates open recursion; enables cache snooping or amplification.

Wildcard Detection

┌──(kali㉿kali)-[~]
└─$ dig nonexistent123.$DOMAIN @$TARGET_IP +short

Resolution confirms wildcard; brute force results need filtering.

Additional Probes

Authoritative NS:

┌──(kali㉿kali)-[~]
└─$ dig NS $DOMAIN @$TARGET_IP

SOA details:

┌──(kali㉿kali)-[~]
└─$ dig SOA $DOMAIN @$TARGET_IP

DNSSEC support:

┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN +dnssec @$TARGET_IP

Transport test:

┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN @$TARGET_IP +tcp
┌──(kali㉿kali)-[~]
└─$ dig $DOMAIN @$TARGET_IP +notcp

TTL inspection:

┌──(kali㉿kali)-[~]
└─$ dig A $DOMAIN @$TARGET_IP +ttlunits

Resolution trace:

┌──(kali㉿kali)-[~]
└─$ dig +trace $DOMAIN

Reverse authority:

┌──(kali㉿kali)-[~]
└─$ dig -x $TARGET_IP @$TARGET_IP

Open recursion and wildcard behavior expand the attack surface. For zones that allow unauthenticated updates, see Insecure DNS Dynamic Updates. For AD-integrated DNS poisoning via wildcards and WPAD records, see ADIDNS Poisoning and Hijacking and WPAD DNS Credential Capture with Responder.