DNSRecon Reverse Lookup and Record Enumeration
As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to map specific DNSRecon flags (-r, -n, -t) to their functions, specifically distinguishing between standard enumeration (std) and brute force (brt).
This question tests the correct use of DNSRecon for performing reverse DNS lookups and enumerating standard records like NS and MX against a target IP range.
Candidates often select the 'brt' option, confusing standard record retrieval with dictionary-based brute forcing of subdomains.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question requires two main actions: reverse DNS lookup on an IP range and identification of NS/MX records. Option C uses-r to specify the IP range 162.241.216.0/24, which triggers the reverse lookup. It specifies -n nsl.example.com as the nameserver to query. Crucially, it uses -t std, which performs standard enumeration including SOA, NS, A, AAAA, MX, and SRV records. This directly satisfies the requirement to find NS and MX records alongside the reverse lookups.Why the Other Options Are Wrong
Option A (-t axfr) attempts a zone transfer, which is a distinct attack vector not mentioned in the prompt. Option B (-t zonewalk) is used to walk zones, which is also not the primary goal here. Option D (-t brt) performs brute-force domain enumeration using a dictionary file, which does not perform reverse DNS lookups on the specified IP range nor retrieve existing MX records from the target's configuration.Community Comment Notes
Community consensus strongly supports C. As user pindinga1 noted, "The -t std option performs standard enumeration, which includes: Reverse lookups..." Another commenter emphasized that "the -t std is able to find out the requested information without the need of -t brt," highlighting the distinction between standard queries and brute-forcing.Exam Strategy
Memorize the short flag descriptions for key tools. For DNSRecon, remember that -t std is your go-to for general record discovery (NS, MX, A), while -t axfr is for zone transfers and -t brt is for brute-forcing hostnames.
Frequently Asked Questions
What does the -t std flag do in DNSRecon?
It performs standard enumeration, querying for SOA, NS, A, AAAA, MX, and SRV records.
When should I use -t brt instead of -t std?
Use -t brt when you need to discover subdomains or hosts by guessing names against a dictionary, rather than querying existing records.