Root Index | ISCSECURITY Masterclass Series
Zane A. — Security Consultant
IP Addresses & DNS: The Backbone of Modern Reconnaissance
Every connection to an organization's infrastructure begins with two simple questions:
1. what is the address?
2. what name resolves to it?
IP addresses provide the coordinates, while DNS provides the directory. Together they form the outermost layer of the attack surface, and they remain the most consistently reliable sources of intelligence for both adversaries and defenders.
Understanding how reconnaissance operates at this layer is not merely an offensive discipline. For defenders, knowing what the internet exposes about your organization; without ever sending a packet to your perimeter is the foundation of attack surface management.
1. Passive Reconnaissance: Mapping the Network Surface Without a Trace
Before an adversary sends a single probe, they must answer a basic geography question:
- where does the target live on the internet?
This process begins with ownership attribution. Every organization's public presence is registered through Autonomous System Numbers (ASNs) and announced via netblocks. By querying regional internet registries, routing databases, and BGP (Border Gateway Protocol) looking glasses, an adversary can compile a complete inventory of IPv4 and IPv6 space associated with a target.
Cloud environments expand this surface dramatically. Public cloud providers publish their IP ranges, and many organization's leak additional context through peering relationships, historic routing announcements, and misclassified ownership records.
Reputation and geolocation data add further fidelity. Passive APIs reveal not only the carrier and country of origin but also whether an address has been flagged for abuse, belongs to a commercial VPN exit node, or sits within a residential broadband pool. This context shapes everything from target prioritization to evasion planning.
Critically, none of this activity touches the target directly. WHOIS, RDAP, BGP queries, and passive reputation lookups generate zero server-side logs on victim infrastructure. It is pure open-source intelligence, and it often yields a more accurate network map than many internal asset inventories.
2. DNS Enumeration: Harvesting Records, Subdomains, and Misconfigurations.
If IP addresses are the coordinates, DNS is the directory service. And directories are rarely as clean as their administrators believe.
Adversaries begin DNS reconnaissance by extracting the visible records associated with a domain. Mail exchanger records reveal email architecture and often expose third-party security gateways.
TXT records frequently leak vendor relationships through SPF, DKIM, and verification tokens, effectively publishing a partial list of the organization's SaaS providers. Name server records expose infrastructure partners and hosting providers, while historical A and CNAME records trace the migration of services over time.
Zone transfers remain a persistent, if basic, vulnerability. When a DNS server is misconfigured to answer transfer requests from unauthorised hosts, it can divulge the complete internal zone file. Even without this vector, modern adversaries rely heavily on certificate transparency logs.
Every publicly trusted certificate is logged in an open, immutable ledger. Parsing these logs yields subdomains that may never appear in public search engines, including staging environments, admin portals, and legacy APIs.
Brute-forcing subdomains is still common, though noise levels have risen. Sophisticated actors mitigate this by distributing queries across dozens of resolvers, inserting temporal jitter, and cross-referencing findings with passive DNS datasets before attempting validation.
The goal is not merely to find hosts, but to infer internal architecture through naming conventions. A subdomain named jenkins-prod-02.lab.target.com tells a story that a simple IP address cannot.
3. Infrastructure Mapping: Passive Profiling and Active Validation.
Once network ranges and hostnames are collected, the next phase is determining what is actually alive and exposed.
Passive discovery platforms have fundamentally changed reconnaissance. Services like Shodan, Censys, and BinaryEdge continuously scan the entire internet, indexing banners, certificates, and service fingerprints.
An adversary can query these datasets to identify a target's exposed web servers, industrial control systems, remote access gateways, and forgotten IoT devices without ever transmitting a packet toward the organization. Historical DNS services extend this by revealing IP addresses that have since been rotated but may still host vulnerable services or retain weak authentication.
When passive data is exhausted, active scanning bridges the gap. Mass scanning tools can canvass enormous address spaces in minutes, while follow-up service enumeration identifies versions, configurations, and default credentials. Banner grabbing and technology fingerprinting transform raw ports into actionable intelligence, revealing everything from the version of a web framework to the presence of unpatched middleware.
The defensive implication is clear; if an asset is reachable from the internet and speaks any protocol, it will eventually be catalogued by someone. The only question is whether the catalogue builder is a threat actor or your own attack surface management team.
4. Advanced Tactics: Shadow IT, Geolocation, and Covert Channels.
Sophisticated adversaries do not stop at obvious infrastructure. They hunt for the edges of the estate.
Geolocation data enables target prioritization and pretexting. Knowing that a subnet is physically located in a specific city, or that a VPN concentrator serves a particular region, informs both technical targeting and social engineering narratives.
Shadow IT and cloud storage enumeration represent particularly fertile ground. Organizations frequently provision S3 buckets, Azure blob stores, and Google Cloud Platform (GCP) containers with predictable naming conventions. When these buckets are misconfigured for public access or retain legacy permissions after a project ends, they become data leakage points.
Similarly, subdomain takeover occurs when a DNS record points to a cloud resource that has been decommissioned but not removed from the zone file. An adversary can reclaim the underlying resource and effectively host content under the target’s trusted domain.
DNS itself is increasingly abused as a covert channel.
Tunneling malware encodes data inside DNS queries and responses, leveraging the fact that most environments allow outbound DNS by default. The queries may be directed through standard port 53, or more recently, hidden within DNS-over-HTTPS traffic to blend in with normal browser behaviour. Other abuses include cache poisoning, which redirects legitimate traffic to attacker infrastructure; amplification attacks, which exploit open resolvers to fuel denial-of-service campaigns; and outright hijacking of registrar accounts to modify authoritative name server records.
5. Adversary OPSEC and Evasion Techniques:
Reconnaissance is not simply about collection; it is about remaining undetected during collection.
Adversaries adopt a passive-first workflow, exhausting open-source datasets before ever running an active scan. When active probing becomes necessary, operational security measures govern the operation. Scanner IPs are vetted against commercial blocklists and threat intelligence feeds to avoid immediate flagging. Traffic is often routed through residential proxies or compromised edge devices to fragment the attack origin.
Temporal jitter spaces scans across hours or days, preventing temporal correlation by intrusion detection systems. Resolver rotation distributes DNS queries across public and private infrastructure, while metadata sanitization strips identifying tool signatures from requests. Adversaries also increasingly exploit protocol-level evasion, such as IP fragmentation and non-standard source ports, to bypass simplistic firewall logging.
A growing area of evasion is the deliberate targeting of IPv6 space. Many organization's monitor and defend IPv4 aggressively while leaving IPv6 prefixes effectively unobserved. For attackers, this represents a reliable blind spot.
6. Defensive Countermeasures and Threat Mapping:
What is visible to an attacker must first be visible to the defender.
DNSSEC should be implemented across all public zones to prevent cache poisoning and ensure record integrity. Zone transfers must be explicitly restricted to known, authenticated secondary name servers. Split-horizon DNS architectures should ensure that internal namespace and naming conventions are never exposed externally.
Continuous asset hygiene is non-negotiable. Decommissioned development hosts, forgotten staging subdomains, and expired cloud resources must be removed from both DNS and the provider console. TXT records should be audited regularly to ensure they are not leaking vendor relationships or internal architecture. SPF and DKIM records serve a mail security purpose, but they also function as intelligence sources; treat them accordingly.
Organizations should subscribe to continuous attack surface management, regularly querying passive internet scanners for their own netblocks, autonomous systems, and certificate fingerprints. Registrar accounts require the highest level of protection: multi-factor authentication, registry lock, and monitoring for unauthorised changes. Geolocation and ASN anomaly detection should be embedded within SIEM rules to flag inbound connections from unexpected regions or providers.
Finally, DNS firewalling and Response Policy Zones can sinkhole known malicious domains at the resolver level, while inspection policies for DNS-over-HTTPS traffic prevent tunneling from bypassing traditional logging controls entirely.
Key Takeaways:
1. Passive ASN, WHOIS, RDAP, and BGP reconnaissance generates no traffic to the target, yet often produces a complete network map.
2. Certificate transparency logs are high-yield intelligence sources; they expose subdomains and infrastructure without ever querying the target's name servers.
3. Misconfigured DNS zone transfers remain viable in modern environments and can leak internal zone architecture in seconds.
4. Internet scanning platforms like Shodan and Censys profile your exposed hosts continuously; assume adversaries have already queried them.
5. Active scanning demands rigorous operational security; without exit-node vetting, proxy distribution, and jitter, reconnaissance becomes an active incident.
6. DNS tunneling and DNS-over-HTTPS abuse are preferred covert channels; monitor for anomalous query lengths, volumes, and uncommon destination domains.
7. Cloud bucket enumeration and subdomain takeover are still commonplace; predictable naming and poor offboarding create persistent exposure.
8. IPv6 is a consistent defensive blind spot; monitoring gaps in IPv6 space are routinely exploited for initial access.
9. DNSSEC, AXFR restrictions, split-horizon DNS, and continuous asset hygiene remain essential baseline controls that neutralize a significant volume of reconnaissance-driven attacks.
Run this scenario in your head,
If an adversary ran passive ASN and WHOIS reconnaissance, harvested certificate transparency logs, and enumerated cloud storage prefixes against your organization today, what forgotten subdomains, exposed netblocks, dangling DNS records, orphaned buckets, or undocumented IPv6 prefixes would they surface?
DNS and IP intelligence form the backbone of all reconnaissance. Collect, correlate, and confirm before you ever engage.
Passive reconnaissance leaves no trace; active scanning leaves no excuse for poor operational security. Treat your infrastructure like an adversary would, then defend it accordingly.
ISCSECURITY Master Class Series: https://iscsecurity.org
Discussion: https://cyberr.ai/groups/iscsecurity
GitHub: github.com/zanderson73/
0 reactions · 0 comments