05 Flashcards
The ________ function is sent as the hexadecimal characters __________ and ____________
EOL, 0x0d0a, 0x0d
_____ Host - mapping FQDN to IPv4 address (Forward Lookup)
A1
_____ Canonical Name, Mapping, Alias (commonly used for web servers)
Cname5
____ Mail Exchanger (email servers)
MX15
_____ Pointer – mapping IP to FQDN (Reverse Lookup)
PTR12
____ Start of authority - best source of information for this domain.
SOA6
____ Service Location - locate servers hosting services for a specific
domain. SRV records allow for built-in load balancing of multiple
servers using the priority and weight values in the records.
SRV33
____ Host – mapping FQDN to IPv6 host addresse
AAAA28
____ Zone transfer - transfers of DNS cache/database
AXFR252
___________ involves an individual or malicious software (malware) gathering and
transmitting information by placing information at the beginning of a valid FQDN.
DNS Exfiltration
How do I see all dns header traffic? How do i see more of it?
dns
udp.port == 53
How do I see all valid responses from a server?
dns.a
How do I find specific query types?
dns.qry.type == 1
How do I find all queries/responses specified with a FQDN?
dns.qry.name == “FQDN”
How do I see all dns responses/requests?
dns.flags gt 8000 responses
dns.flags lt 8000
requests