Common Attack Pattern Enumeration and Classification
A Community Resource for Identifying and Understanding Attacks
An attacker enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a Firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.
Target Attack Surface Description
Targeted OSI Layers: Application Layer
Target Attack Surface Localities
Target Attack Surface Types: Service
Target Functional Services
A command-line utility or other application capable of sending requests to the DNS server is necessary.
[R.290.1] [REF-20] Stuart McClure, Joel Scambray and George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". Chapter 2: Scanning, pp. 38. 6th Edition. McGraw Hill. 2009.
More information is available — Please select a different filter.