PT0-001 · Question #45
A penetration tester wants to script out a way to discover all the RPTR records for a range of IP addresses. Which of the following is the MOST efficient to utilize?
The correct answer is C. for x in {1...254}; do dig -x 192.168.$x.$x; done. The dig -x flag performs reverse DNS (PTR) lookups, and a bash for loop is the most efficient scripted method to enumerate PTR records across an IP range.
Question
A penetration tester wants to script out a way to discover all the RPTR records for a range of IP addresses. Which of the following is the MOST efficient to utilize?
Options
- Anmap -p 53 -oG dnslist.txt | cut -d ":" -f 4
- Bnslookup -ns 8.8.8.8 << dnslist.txt
- Cfor x in {1...254}; do dig -x 192.168.$x.$x; done
- Ddig -r > echo "8.8.8.8" >> /etc/resolv.conf
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C85% (23)
- D4% (1)
Why each option
The dig -x flag performs reverse DNS (PTR) lookups, and a bash for loop is the most efficient scripted method to enumerate PTR records across an IP range.
nmap with -p 53 scans for open DNS service ports but does not perform reverse DNS lookups, and the cut command would not extract PTR record data from that output.
nslookup does not support a -ns flag combined with heredoc input in this syntax, and this command would not iterate over an IP range to perform reverse DNS lookups.
The dig -x flag instructs dig to perform a reverse DNS lookup, querying PTR records for a given IP address. A bash for loop iterating from 1 to 254 automates this across an entire subnet, making it the most direct and efficient scripted approach for bulk PTR record enumeration without requiring additional parsing.
dig -r is not a valid reverse lookup flag, and appending to /etc/resolv.conf modifies the system DNS resolver configuration rather than querying PTR records.
Concept tested: Scripted reverse DNS PTR record enumeration
Source: https://linux.die.net/man/1/dig
Topics
Community Discussion
No community discussion yet for this question.