-: nslookup, dig and hostname. 2 2
Now in this video, we're going to cover 3 3
nslookup, dig, and hostname. 4 4
These are three command line tools, 5 5
and you need to understand how to use them 6 6
in maintaining and troubleshooting your networks. 7 7
First, we have nslookup. 8 8
nslookup stands for name server lookup, 9 9
and it's going to be used to query the domain name system 10 10
to provide the mapping between domain names and IP addresses 11 11
or other DNS records. 12 12
Now, if we need to get the IP address 13 13
of a fully qualified domain name nslookup is the tool 14 14
that will help us do that. 15 15
For example, let's pretend you wanted to find out 16 16
the IP address for diontraining.com. 17 17
Well, you can open up your command prompt 18 18
and you can type in nslookup www.diontraining.com 19 19
and press enter. 20 20
When you do that, 21 21
you're going to get the IP address shown on your screen 22 22
that tells you where Dion Training servers are. 23 23
Now, when you enter the command and the domain name 24 24
like this, in all one line, 25 25
we call this the non-interactive mode. 26 26
Now with non-interactive modes, 27 27
you're going to be able to display just the name 28 28
and the requested information for a host or domain name 29 29
to your screen. 30 30
But you can also use nslookup in an interactive mode. 31 31
Now interactive mode allows a user to query name servers 32 32
for information about various hosts and domains, 33 33
or allows them to print a list of hosts inside of a domain. 34 34
To enter the interactive mode, 35 35
you just type nslookup at the prompt and hit enter. 36 36
Now you're going to enter the nslookup shell, 37 37
and you can perform more in-depth queries here. 38 38
Using this interactive mode will allow you to have 39 39
more detailed control over the environment, 40 40
including allowing you to change the server you're using 41 41
to conduct those look-ups 42 42
and changing the different types of records 43 43
that you want to respond with. 44 44
Now, if you want to change the DNS server that's being used 45 45
for the query, just enter the term server, 46 46
and the DNS servers name or IP address and hit enter. 47 47
Now, if you instead want to change 48 48
the type of record you want to search for, 49 49
you can enter set q equals and then the record type. 50 50
This stands for set query type equals, and then that thing. 51 51
So for example, if I wanted to search for mail records, 52 52
which are known as mx records in DNS, 53 53
I would type set q equals mx and hit enter. 54 54
Then, I get my next prompt 55 55
and I can start searching mail records for any domain name. 56 56
So, I'm going to be able to find 57 57
all the different mail records, 58 58
for instance, for diontraining.com. 59 59
Here, I can see all five mail exchange server records 60 60
for diontraining.com, 61 61
and you can see they're all hosted by Google 62 62
because Google Workspace is what we use 63 63
for our company's email and file servers. 64 64
Now next to each mx record, you can also see the preferences 65 65
with one being the highest preference 66 66
and the two being listed with five 67 67
acting in a load balance configuration. 68 68
And then, we have those backed up 69 69
by two more exchange mail servers 70 70
that have a preference of 10, 71 71
which has also load balance between those two servers. 72 72
Next, let's search for some CNAME or canonical name records. 73 73
To do this, I first need to set my query type to CNAME 74 74
because we're still set to mx records at this point in time. 75 75
So I'm going to enter set q equals CNAME and hit enter. 76 76
Then, I enter the domain name 77 77
that I want to get the CNAME records for. 78 78
And again in this case, I'm going to use diontraining.com. 79 79
Now, in response to this, 80 80
the nslookup is going to display all the CNAME records 81 81
right there on my screen. 82 82
Here, I'm just showing you the first one, 83 83
because I have about 20 different CNAME records 84 84
for diontraining.com. 85 85
If we scroll down through these screens, 86 86
you'd be able to see each and every one of them. 87 87
As you can see, nslookup is a very useful tool 88 88
when it comes to troubleshooting your DNS records 89 89
and other DNS issues that you may be experiencing. 90 90
If you become a cybersecurity analyst 91 91
later on in your career, 92 92
you can also use nslookup to conduct reconnaissance 93 93
against other organizations 94 94
that you may be hired to work for during a penetration test. 95 95
nslookup exists for Windows, Linux, Unix, and OS X systems. 96 96
In these examples, I was using the Windows version, 97 97
but the other versions operate the exact same way. 98 98
The only difference you're going to see 99 99
is that instead of using something like set type equals mx, 100 100
instead of set q equals mx, 101 101
if you're using things on a Linux, Unix or OS X system 102 102
and doing record type searches. 103 103
Next we have the dig command. 104 104
dig is another tool that's used to conduct queries 105 105
against DNS name servers. 106 106
dig is only available for Linux, Unix, and OS X systems 107 107
by default, 108 108
but there are Windows versions that can be installed 109 109
if you'd like to use it on a Windows machine. 110 110
Now to use dig, 111 111
it works a lot like the non-interactive mode of nslookup. 112 112
If you enter dig and the domain name like diontraining.com, 113 113
you're going to get back the A records for that domain name 114 114
and those A records contain the IP addresses 115 115
for that domain. 116 116
Now, in this example, 117 117
you can see there are two A records for diontraining.com 118 118
because we use a load balancing web cluster 119 119
to host our website. 120 120
Now, dig does not support an interactive mode 121 121
the way nslookup does. 122 122
So, if you want to search for other types of records, 123 123
you're simply going to specify those 124 124
when entering the command. 125 125
For example, 126 126
let's say I wanted to look for those mail exchange 127 127
or mx records. 128 128
I'm going to enter dig-t, which stands for type, and then mx, 129 129
which stands for male exchange. 130 130
And then, I'm going to enter the domain name 131 131
in this case, diontraining.com. 132 132
Here again, you can see we have five mx records 133 133
associated with diontraining.com 134 134
and they're all pointing to the Google Mail servers 135 135
because that's who's hosting our company's email 136 136
using Google Workspaces. 137 137
Now finally, we have the hostname command. 138 138
The hostname command is going to be used 139 139
to display the hostname portion of the full computer name 140 140
for a given system. 141 141
Now, the hostname command works on Windows, Linux, 142 142
Unix, and OS X operating systems. 143 143
Now to use hostname, you simply enter hostname 144 144
and press enter at the command prompt. 145 145
As an example, I entered the hostname command 146 146
on an OS X system here. 147 147
In this case, my MacBook Pro. 148 148
Now you can quickly see the full name of my laptop 149 149
is Jasons-MBP.localdomain. 150 150
Now this means the computer is going to be named 151 151
Jason's MacBook Pro or Jason's MBP, 152 152
and it exists on a local domain. 153 153
because here I'm not connected 154 154
to an Active Directory-based domain environment. 155 155
At some organizations I've worked for in the past, 156 156
we run large Active Directory-based Windows domains. 157 157
And for those systems, you might see something like, 158 158
Jasons-PC.intranet.diontraining.com, 159 159
as its FQDN or fully qualified host and domain name, 160 160
since it's becoming a member of that domain. 161 161
(playful instrumental music)