1 1 00:00:00,529 --> 00:00:03,390 nslookup, dig and hostname. 2 2 00:00:03,390 --> 00:00:05,416 Now in this video, we're going to cover 3 3 00:00:05,416 --> 00:00:07,760 nslookup, dig, and hostname. 4 4 00:00:07,760 --> 00:00:09,640 These are three command line tools, 5 5 00:00:09,640 --> 00:00:11,330 and you need to understand how to use them 6 6 00:00:11,330 --> 00:00:13,700 in maintaining and troubleshooting your networks. 7 7 00:00:13,700 --> 00:00:15,716 First, we have nslookup. 8 8 00:00:15,716 --> 00:00:18,100 nslookup stands for name server lookup, 9 9 00:00:18,100 --> 00:00:20,810 and it's going to be used to query the domain name system 10 10 00:00:20,810 --> 00:00:23,900 to provide the mapping between domain names and IP addresses 11 11 00:00:23,900 --> 00:00:25,610 or other DNS records. 12 12 00:00:25,610 --> 00:00:27,410 Now, if we need to get the IP address 13 13 00:00:27,410 --> 00:00:30,430 of a fully qualified domain name nslookup is the tool 14 14 00:00:30,430 --> 00:00:32,050 that will help us do that. 15 15 00:00:32,050 --> 00:00:34,190 For example, let's pretend you wanted to find out 16 16 00:00:34,190 --> 00:00:36,730 the IP address for diontraining.com. 17 17 00:00:36,730 --> 00:00:38,740 Well, you can open up your command prompt 18 18 00:00:38,740 --> 00:00:42,780 and you can type in nslookup www.diontraining.com 19 19 00:00:42,780 --> 00:00:43,920 and press enter. 20 20 00:00:43,920 --> 00:00:44,870 When you do that, 21 21 00:00:44,870 --> 00:00:47,210 you're going to get the IP address shown on your screen 22 22 00:00:47,210 --> 00:00:49,770 that tells you where Dion Training servers are. 23 23 00:00:49,770 --> 00:00:51,840 Now, when you enter the command and the domain name 24 24 00:00:51,840 --> 00:00:53,810 like this, in all one line, 25 25 00:00:53,810 --> 00:00:56,520 we call this the non-interactive mode. 26 26 00:00:56,520 --> 00:00:58,260 Now with non-interactive modes, 27 27 00:00:58,260 --> 00:01:00,060 you're going to be able to display just the name 28 28 00:01:00,060 --> 00:01:02,600 and the requested information for a host or domain name 29 29 00:01:02,600 --> 00:01:03,820 to your screen. 30 30 00:01:03,820 --> 00:01:07,340 But you can also use nslookup in an interactive mode. 31 31 00:01:07,340 --> 00:01:10,150 Now interactive mode allows a user to query name servers 32 32 00:01:10,150 --> 00:01:12,800 for information about various hosts and domains, 33 33 00:01:12,800 --> 00:01:16,220 or allows them to print a list of hosts inside of a domain. 34 34 00:01:16,220 --> 00:01:17,720 To enter the interactive mode, 35 35 00:01:17,720 --> 00:01:20,800 you just type nslookup at the prompt and hit enter. 36 36 00:01:20,800 --> 00:01:23,260 Now you're going to enter the nslookup shell, 37 37 00:01:23,260 --> 00:01:25,710 and you can perform more in-depth queries here. 38 38 00:01:25,710 --> 00:01:27,750 Using this interactive mode will allow you to have 39 39 00:01:27,750 --> 00:01:29,950 more detailed control over the environment, 40 40 00:01:29,950 --> 00:01:32,460 including allowing you to change the server you're using 41 41 00:01:32,460 --> 00:01:33,830 to conduct those look-ups 42 42 00:01:33,830 --> 00:01:35,290 and changing the different types of records 43 43 00:01:35,290 --> 00:01:36,960 that you want to respond with. 44 44 00:01:36,960 --> 00:01:39,200 Now, if you want to change the DNS server that's being used 45 45 00:01:39,200 --> 00:01:41,750 for the query, just enter the term server, 46 46 00:01:41,750 --> 00:01:45,270 and the DNS servers name or IP address and hit enter. 47 47 00:01:45,270 --> 00:01:46,640 Now, if you instead want to change 48 48 00:01:46,640 --> 00:01:48,470 the type of record you want to search for, 49 49 00:01:48,470 --> 00:01:52,220 you can enter set q equals and then the record type. 50 50 00:01:52,220 --> 00:01:56,080 This stands for set query type equals, and then that thing. 51 51 00:01:56,080 --> 00:01:58,790 So for example, if I wanted to search for mail records, 52 52 00:01:58,790 --> 00:02:00,950 which are known as mx records in DNS, 53 53 00:02:00,950 --> 00:02:05,040 I would type set q equals mx and hit enter. 54 54 00:02:05,040 --> 00:02:06,640 Then, I get my next prompt 55 55 00:02:06,640 --> 00:02:09,370 and I can start searching mail records for any domain name. 56 56 00:02:09,370 --> 00:02:10,330 So, I'm going to be able to find 57 57 00:02:10,330 --> 00:02:11,600 all the different mail records, 58 58 00:02:11,600 --> 00:02:13,770 for instance, for diontraining.com. 59 59 00:02:13,770 --> 00:02:16,730 Here, I can see all five mail exchange server records 60 60 00:02:16,730 --> 00:02:18,240 for diontraining.com, 61 61 00:02:18,240 --> 00:02:20,470 and you can see they're all hosted by Google 62 62 00:02:20,470 --> 00:02:22,390 because Google Workspace is what we use 63 63 00:02:22,390 --> 00:02:24,770 for our company's email and file servers. 64 64 00:02:24,770 --> 00:02:28,130 Now next to each mx record, you can also see the preferences 65 65 00:02:28,130 --> 00:02:29,910 with one being the highest preference 66 66 00:02:29,910 --> 00:02:31,430 and the two being listed with five 67 67 00:02:31,430 --> 00:02:33,460 acting in a load balance configuration. 68 68 00:02:33,460 --> 00:02:34,900 And then, we have those backed up 69 69 00:02:34,900 --> 00:02:36,860 by two more exchange mail servers 70 70 00:02:36,860 --> 00:02:38,390 that have a preference of 10, 71 71 00:02:38,390 --> 00:02:41,460 which has also load balance between those two servers. 72 72 00:02:41,460 --> 00:02:45,130 Next, let's search for some CNAME or canonical name records. 73 73 00:02:45,130 --> 00:02:48,070 To do this, I first need to set my query type to CNAME 74 74 00:02:48,070 --> 00:02:51,110 because we're still set to mx records at this point in time. 75 75 00:02:51,110 --> 00:02:55,290 So I'm going to enter set q equals CNAME and hit enter. 76 76 00:02:55,290 --> 00:02:56,870 Then, I enter the domain name 77 77 00:02:56,870 --> 00:02:58,920 that I want to get the CNAME records for. 78 78 00:02:58,920 --> 00:03:02,070 And again in this case, I'm going to use diontraining.com. 79 79 00:03:02,070 --> 00:03:03,290 Now, in response to this, 80 80 00:03:03,290 --> 00:03:06,180 the nslookup is going to display all the CNAME records 81 81 00:03:06,180 --> 00:03:07,830 right there on my screen. 82 82 00:03:07,830 --> 00:03:09,820 Here, I'm just showing you the first one, 83 83 00:03:09,820 --> 00:03:11,930 because I have about 20 different CNAME records 84 84 00:03:11,930 --> 00:03:13,470 for diontraining.com. 85 85 00:03:13,470 --> 00:03:15,140 If we scroll down through these screens, 86 86 00:03:15,140 --> 00:03:17,500 you'd be able to see each and every one of them. 87 87 00:03:17,500 --> 00:03:20,270 As you can see, nslookup is a very useful tool 88 88 00:03:20,270 --> 00:03:22,330 when it comes to troubleshooting your DNS records 89 89 00:03:22,330 --> 00:03:25,150 and other DNS issues that you may be experiencing. 90 90 00:03:25,150 --> 00:03:26,820 If you become a cybersecurity analyst 91 91 00:03:26,820 --> 00:03:27,920 later on in your career, 92 92 00:03:27,920 --> 00:03:30,230 you can also use nslookup to conduct reconnaissance 93 93 00:03:30,230 --> 00:03:31,640 against other organizations 94 94 00:03:31,640 --> 00:03:34,220 that you may be hired to work for during a penetration test. 95 95 00:03:34,220 --> 00:03:39,220 nslookup exists for Windows, Linux, Unix, and OS X systems. 96 96 00:03:39,360 --> 00:03:41,830 In these examples, I was using the Windows version, 97 97 00:03:41,830 --> 00:03:44,920 but the other versions operate the exact same way. 98 98 00:03:44,920 --> 00:03:46,380 The only difference you're going to see 99 99 00:03:46,380 --> 00:03:49,530 is that instead of using something like set type equals mx, 100 100 00:03:49,530 --> 00:03:51,710 instead of set q equals mx, 101 101 00:03:51,710 --> 00:03:54,860 if you're using things on a Linux, Unix or OS X system 102 102 00:03:54,860 --> 00:03:56,790 and doing record type searches. 103 103 00:03:56,790 --> 00:03:58,610 Next we have the dig command. 104 104 00:03:58,610 --> 00:04:00,710 dig is another tool that's used to conduct queries 105 105 00:04:00,710 --> 00:04:02,550 against DNS name servers. 106 106 00:04:02,550 --> 00:04:05,790 dig is only available for Linux, Unix, and OS X systems 107 107 00:04:05,790 --> 00:04:06,623 by default, 108 108 00:04:06,623 --> 00:04:09,140 but there are Windows versions that can be installed 109 109 00:04:09,140 --> 00:04:11,550 if you'd like to use it on a Windows machine. 110 110 00:04:11,550 --> 00:04:12,640 Now to use dig, 111 111 00:04:12,640 --> 00:04:15,850 it works a lot like the non-interactive mode of nslookup. 112 112 00:04:15,850 --> 00:04:19,180 If you enter dig and the domain name like diontraining.com, 113 113 00:04:19,180 --> 00:04:21,650 you're going to get back the A records for that domain name 114 114 00:04:21,650 --> 00:04:23,870 and those A records contain the IP addresses 115 115 00:04:23,870 --> 00:04:25,200 for that domain. 116 116 00:04:25,200 --> 00:04:26,330 Now, in this example, 117 117 00:04:26,330 --> 00:04:29,210 you can see there are two A records for diontraining.com 118 118 00:04:29,210 --> 00:04:31,550 because we use a load balancing web cluster 119 119 00:04:31,550 --> 00:04:33,110 to host our website. 120 120 00:04:33,110 --> 00:04:35,610 Now, dig does not support an interactive mode 121 121 00:04:35,610 --> 00:04:37,000 the way nslookup does. 122 122 00:04:37,000 --> 00:04:39,440 So, if you want to search for other types of records, 123 123 00:04:39,440 --> 00:04:40,940 you're simply going to specify those 124 124 00:04:40,940 --> 00:04:42,350 when entering the command. 125 125 00:04:42,350 --> 00:04:43,200 For example, 126 126 00:04:43,200 --> 00:04:45,100 let's say I wanted to look for those mail exchange 127 127 00:04:45,100 --> 00:04:46,420 or mx records. 128 128 00:04:46,420 --> 00:04:50,470 I'm going to enter dig-t, which stands for type, and then mx, 129 129 00:04:50,470 --> 00:04:51,900 which stands for male exchange. 130 130 00:04:51,900 --> 00:04:53,710 And then, I'm going to enter the domain name 131 131 00:04:53,710 --> 00:04:56,100 in this case, diontraining.com. 132 132 00:04:56,100 --> 00:04:58,650 Here again, you can see we have five mx records 133 133 00:04:58,650 --> 00:05:00,480 associated with diontraining.com 134 134 00:05:00,480 --> 00:05:02,690 and they're all pointing to the Google Mail servers 135 135 00:05:02,690 --> 00:05:04,780 because that's who's hosting our company's email 136 136 00:05:04,780 --> 00:05:06,730 using Google Workspaces. 137 137 00:05:06,730 --> 00:05:09,130 Now finally, we have the hostname command. 138 138 00:05:09,130 --> 00:05:10,660 The hostname command is going to be used 139 139 00:05:10,660 --> 00:05:13,330 to display the hostname portion of the full computer name 140 140 00:05:13,330 --> 00:05:14,710 for a given system. 141 141 00:05:14,710 --> 00:05:17,590 Now, the hostname command works on Windows, Linux, 142 142 00:05:17,590 --> 00:05:20,090 Unix, and OS X operating systems. 143 143 00:05:20,090 --> 00:05:22,640 Now to use hostname, you simply enter hostname 144 144 00:05:22,640 --> 00:05:24,810 and press enter at the command prompt. 145 145 00:05:24,810 --> 00:05:27,110 As an example, I entered the hostname command 146 146 00:05:27,110 --> 00:05:28,690 on an OS X system here. 147 147 00:05:28,690 --> 00:05:30,700 In this case, my MacBook Pro. 148 148 00:05:30,700 --> 00:05:33,160 Now you can quickly see the full name of my laptop 149 149 00:05:33,160 --> 00:05:35,433 is Jasons-MBP.localdomain. 150 150 00:05:36,530 --> 00:05:38,330 Now this means the computer is going to be named 151 151 00:05:38,330 --> 00:05:40,920 Jason's MacBook Pro or Jason's MBP, 152 152 00:05:40,920 --> 00:05:42,980 and it exists on a local domain. 153 153 00:05:42,980 --> 00:05:44,420 because here I'm not connected 154 154 00:05:44,420 --> 00:05:46,970 to an Active Directory-based domain environment. 155 155 00:05:46,970 --> 00:05:49,070 At some organizations I've worked for in the past, 156 156 00:05:49,070 --> 00:05:51,980 we run large Active Directory-based Windows domains. 157 157 00:05:51,980 --> 00:05:54,360 And for those systems, you might see something like, 158 158 00:05:54,360 --> 00:05:57,960 Jasons-PC.intranet.diontraining.com, 159 159 00:05:57,960 --> 00:06:01,740 as its FQDN or fully qualified host and domain name, 160 160 00:06:01,740 --> 00:06:03,940 since it's becoming a member of that domain. 161 161 00:06:05,084 --> 00:06:07,300 (playful instrumental music)