Domain Name Investigation under cyber forensic

This document explains the Domain Name Investigation in Cyber forensics.

2. Introduction to Domain Name
Inlaymanlanguagethewebsiteisalsoknownas
domainname.Incyberworldsomedomainnamemay
berelatedtocybercrime.Thisdomainnameprovides
ahugeamountofinformationrelatedtocyber
criminals.criminals.
DNSstandsforDomainNameSystem.Itresolvesthe
websitenametoitscorrespondingIPaddress.Inother
words,theobjectiveofDNSistoresolvethefully
qualifieddomainname(FQDN)intoanIPaddress.
Thisprocessisknownasnameresolution.

3. DNS Zones
TheDNShastwozones,thefirstzoneisknownas
forwardlookupzoneandthesecondisknownasthe
reverselookupzone.
ForwardLookupzone------DomaintoIPaddress
ReverseLookupzone-------IPtoDomainname
DNSperformsthequeryusingtheDNSdatabase.The
databasecontainsIPaddress,Hostname,MXrecord,
etc.ThestructureoftheDNSdatabaseisdistributed,
replicated,andhierarchicalinnature

4. DNS Database

5. DNS Database

6. CNAME Record

CNAME Record map one domain name to another
domain name

7. A Record

8. MX Record

9. SOA Record

SOA record is also known as Start of Authority Record.
It basically contains master and slave DNS record for
sync purpose only.

10. Time to live (TTL)

Timetolive(TTL)iswhatdictateshowlongyourrecords
staycached.Forexample,forhowlongyourArecordwill
becachedbeforetheretrievalofanewcopyofthe
recordfromDNSservers.Therecordstorageisknownas
theDNSCache,andtheactofstoringrecordsiscalled
cachingcaching

11. Time to live (TTL)

Theunitsusedareseconds.AnoldercommonTTLvalueforDNSwas
86400seconds,whichis24hours.ATTLvalueof86400wouldmeanthat,
ifaDNSrecordwaschangedontheauthoritativenameserver,DNSservers
aroundtheworldcouldstillbeshowingtheoldvaluefromtheircachefor
upto24hoursafterthechange.

12. Nameserver

ADNSresolverisapieceofsoftwarethatinitiatesDNSquerieswhenever
youtrytoaccessawebsiteorinternetresourcebydomainname.The
resolvercontactsnameserversandasks“WhatistheIPaddressforthis
domainname?”

ThenameserveristhededicatedservercomputerthathastheDNSrecords
storedandwhichlooksuptherightIPaddresstosendbacktotheresolver.

13. Authoritative server

AnAuthoritativeserverprovidesdefinitiveanswersto
DNSqueries,suchasmailserverIPaddressorwebsite
IPaddress(Aresourcerecord).Itdoesnotsimply
returncachedresponsesfromanothernameserver,
butratherprovidesanswerstoqueriesaboutdomain
namesthatareconfiguredinitssystem.namesthatareconfiguredinitssystem.
Note:-“Authoritativenameserver"and"nameserver"
arenotthesame.Whileallauthoritativeserversare
nameservers,notallnameserversare
authoritative;somenameserversarerecursive
resolvers,whicharenotauthoritative.

14. Commands

16. How DNS works in details

SupposeanorganizationABCismanagedbythreedepartmentsHR,
Accounts,andIT.

Theownermonitorstheperformanceoftheorganization.Thedepartments
HR,accounts,andIThave5memberseach.

Supposeanyonewantstocontactamemberofanydepartment.The
questionariseswherehe/sheshouldcontactfirst.

Hence,youhavetochecksalistofnamesalongwithphonenumbers.WeHence,youhavetochecksalistofnamesalongwithphonenumbers.We
knowthateachdepartmenthasaheadofdepartment(HoD)tohandlea
queryofspecificdepartment.
HoDName Department
Anju HR
Rajesh ACCOUNTS
Vishal I.T

17. How DNS works
The members of I.T departments are Mr. Vishalis HoDof I.T department
Members Department
Tom
I.T
Jhon
RameshRamesh

18. How DNS works

The list of members in the HR department are
Members Department
Rudransh
HR
Ivan
Jyoti

19. How DNS works

The list of members in the ACCOUNTSdepartment
Members Department
Shail
ACCOUNTS
NeerajKumar
KPSingh

20. How DNS works

SupposeifanyonewantstocontactMr.Tomworkinginthe
I.T.department,thenhe/shemustfirstcontacttheHoDof
I.T.,thatis,Mr.Vishal,andthenhe/shecancontactthat
particularmember,thatis,TomofI.T.Now,youcan
comparethissituationtoDomainNameandIPaddress.

HereMr.Vishalworksasanameserverandphonenumber

HereMr.Vishalworksasanameserverandphonenumber
equaltoIPaddressrelatedtoaspecificdepartment.You
canassumethedepartmentnameasDomainName
andMr.TomworksasaWebserver.Inthesameway,all
membersofdepartmentsworkasawebserverandHoD
worksasnameservers.Thelistsareworksaszonesfile.

21. DOMAIN NAME INVESTIGATION USING OSINT
Thefirststepinyourinvestigationistovisitthewebpagesofyourtargetcompany.
Thereisalotofimportantinformationthatcanbeobtainedfromatarget's
website.Theyincludebutarenotlimitedtothefollowing.

Physical address

Branch office locations

Key employees

Current job postings (This may reveal technologies used in the company)

Phone numbers

Partner companies

Open hours and holidays

News about target organization (merger or acquisition news)

Technologies used in building the website

Email system used

IT technologies (hardware and software) used by target organization

VPN provider (if any)

Digital files and metadata

Information about the organization’s employees

22. DOMAIN NAME INVESTIGATION USING OSINT
Thenextstepistodetermineandrecordthedomainname
registrationinformation.Thefollowingonlineresources
canbeusedtoobtainregistrationinformation:

www.network-tools.com

www.samspade.org

www.geektools.com

www.geektools.com

www.apnic.net(Asia)

www.checkdomain.com

www.lacnic.net

www.ripe.net(Europe)

www.whois.comwww.dnsstuff.com

23. Domain name registration information
The typical information provided includes—
■Registered owner’s name and address.
■Billing information.
■Administrative contact.
■Range of IP addresses associated with the domain.
Technical contact information. ■Technical contact information.

24. Where’s the evidence?
Information can be found in numerous locations,
including—

User’s computer.

ISP for the user.

ISP for a victim and/or suspect.
Log files contained on the victim’s and/or suspect’s—

Routers.

Firewalls.

Web servers.

E-mail servers.

Other connected devices.

25. Information that may be obtained from the ISP includes

Subscriberinformationsuchastheregisteredowner,
address,andpaymentmethod.

Transactionalinformationsuchasconnectiontimes,
dates,andIPaddressused.
Note:-SomeISPsmaskedtherealinformationof
subscriberstorandominformation.Inthiscaseyousubscriberstorandominformation.Inthiscaseyou
havetocontacttheISPsviae-mail.Exampleisgivenin
nextslide

26. User information

27. Thank you