the DNS administrator's email address to use in a later social engineering attack. The information listed with the DNS registrar is private. Which of the following commands will also disclose the emai

The correct answer is C. nslookup -type=SOA comptia.org. The Start of Authority (SOA) DNS record contains, among other fields, the zone administrator's email address encoded in a specific format (the '@' symbol is replaced with a dot, e.g., admin.example.com represents [email protected]). Unlike WHOIS registrar data (which is marked as

Enterprise Security Operations

Question

the DNS administrator's email address to use in a later social engineering attack. The information listed with the DNS registrar is private. Which of the following commands will also disclose the email address?

Options

Adig -h comptia.org
Bwhois -f comptia.org
Cnslookup -type=SOA comptia.org
Ddnsrecon -i comptia.org -t hostmaster

How the community answered

(23 responses)

A
4% (1)
B
4% (1)
C
83% (19)
D
9% (2)

Explanation

The Start of Authority (SOA) DNS record contains, among other fields, the zone administrator's email address encoded in a specific format (the '@' symbol is replaced with a dot, e.g., admin.example.com represents [email protected]). Unlike WHOIS registrar data (which is marked as private in this scenario), the SOA record is publicly queryable from the authoritative DNS server regardless of registrar privacy settings. Running 'nslookup -type=SOA comptia.org' queries the authoritative name server for the SOA record and returns this email address. Option A ('dig -h') only displays dig's help page. Option B ('whois -f') would query registrar data, which the scenario states is private, and '-f' is not a standard whois flag for email extraction. Option D is not a valid dnsrecon syntax for this purpose.

Topics

#DNS reconnaissance#SOA records#OSINT#social engineering prep

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice