> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/enumeration/information-gathering-enumeration-network.md).

# Network

## DNS Zone Transfer

Using `dig` to attempt a DNS zone transfer (AXFR) from a potentially misconfigured DNS server can reveal all DNS records for a target domain, including subdomains and IP addresses. This can be a significant information gathering technique.

The basic syntax for performing a zone transfer with `dig` is:

```bash
dig axfr @<target_dns_server_ip> <target_domain>
```

For example, targeting `cronos.htb` on server `10.129.227.211`:

```bash
dig axfr @10.129.227.211 cronos.htb
```

Another common example seen involves specifying the domain first, then the server:

```bash
dig axfr example.com @ns1.example.com
```

Alternatively, the `host` command can also be used to perform zone transfers. The syntax for `host` is:

```bash
host -l <target_domain> <target_dns_server_ip>
```

For instance, to perform a zone transfer for `megacorpone.com` from its nameserver `ns1.megacorpone.com`:

```bash
host -l megacorpone.com ns1.megacorpone.com
```

If successful, the output from either `dig axfr` or `host -l` can provide significant information for further enumeration, such as discovering internal hostnames and IP addresses.

***

## Network Scan Using Scapy Arp

Identify active hosts and their MAC addresses on a local subnet by sending ARP requests using Scapy.

Crafting packets in Scapy involves stacking protocol layers. You can create individual layers, such as the Ethernet layer and the ARP layer.

```python
ether_layer = Ether()
```

You can specify fields for each layer, like the destination MAC address for the Ethernet layer.

```python
ether_layer.dst = "ff:ff:ff:ff:ff:ff"
```

Similarly, create an ARP layer.

```python
arp_layer = ARP()
```

Set the target IP range (protocol destination) for the ARP request.

```python
arp_layer.pdst = "10.10.X.X/24" # Replace with your target subnet
```

Stack the layers using the '/' operator to form the complete packet.

```python
packet = ether_layer / arp_layer
```

Using Scapy for network scanning can be structured into functions for clarity and reusability. A common approach involves a function to perform the scan and another to print the results.

To perform the scan, we create an ARP request instance by calling `scapy.ARP()`, setting the `pdst` parameter to the target IP address or IP range. This parameter specifies the destination IP address for our ARP request. We also create an Ethernet frame instance by calling `scapy.Ether()`, setting the `dst` parameter to 'ff:ff:ff:ff:ff:ff', which is the broadcast MAC address. This ensures that our ARP request is sent to all devices on the local network. We then combine the Ethernet frame and the ARP request using the `/` operator, creating a complete packet with the ARP request encapsulated within an Ethernet frame.

We use the `scapy.srp()` function to send the packet and receive responses. The `srp()` function sends and receives packets at layer 2 (Ethernet layer). The `srp()` function returns two lists: `answered_list` and `unanswered_list`. `answered_list` contains the pairs of sent packets and received responses. We iterate over the `answered_list` and extract the IP address (`psrc`) and MAC address (`hwsrc`) from the response packets.

Here is an implementation using functions:

```python
import scapy.all as scapy

def scan(ip, interface):
    # Create an ARP request instance
    arp_request = scapy.ARP(pdst = ip)
    # Create an Ethernet frame instance with broadcast MAC
    broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff")
    # Combine the Ethernet frame and the ARP request
    arp_request_broadcast = broadcast / arp_request
    # Send the packet and receive responses at Layer 2
    # timeout=1 means the function will wait for 1 second for responses
    # verbose=False suppresses detailed output
    answered_list = scapy.srp(arp_request_broadcast, timeout = 1, iface=interface, verbose = False)[0]

    clients_list = []
    # Iterate over the answered_list
    for element in answered_list:
        # element[0] is the sent packet, element[1] is the received packet
        # element[1].psrc is the source IP from the received packet (ARP layer)
        # element[1].hwsrc is the source MAC from the received packet (ARP layer)
        clients_list.append({"ip": element[1].psrc, "mac": element[1].hwsrc})
    return clients_list

def print_result(results_list):
    print("IP Address\t\tMAC Address\n-----------------------------------------")
    for client in results_list:
        print(client["ip"] + "\t\t" + client["mac"])

# Example usage:
# Ensure scapy is installed and imported (e.g., from scapy.all import *)
# Define your network interface
interface = "eth0" # Replace with your interface, e.g., "eth0", "wlan0"
# Define your target IP range
ip_range = "10.10.X.X/24" # Replace with your target subnet, e.g., "192.168.1.1/24"

# Perform the scan
scan_result = scan(ip_range, interface)
# Print the results
print_result(scan_result)
```

This method requires the `scapy` Python library and correct identification of your network interface and the target subnet IP range. The received packets contain the response layers, from which fields like `hwsrc` (hardware source, i.e., MAC) and `psrc` (protocol source, i.e., IP) can be extracted. The `srp` function is suitable for sending and receiving packets at layer 2, like ARP requests. The `timeout` parameter specifies how long to wait for responses, and `verbose=False` keeps the output clean.