Hello, welcome to the Tuesday, October 3, 2017 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and I am recording from Jacksonville, Florida.

Xavier today is looking at instant response with passive DNS.

Now, DNS, of course, is critical in order to figure out what IP address is or was associated with a particular host name. But the problem with incident response, of course, is that the incidents happened in the past and DNS information may have changed since then.

So it's always good to have access to passive DNS data that will tell you what IP address was associated with a particular host name at the time of the incident.

You can collect some of this yourself and Xavier is talking part about that, but there are also a couple

of public resources that you can use to investigate. For example, DNS dumpster is kind of an

interesting website that will tell you more about a particular domain name. Of course, it's also

interesting to know what other host names may have resolved to a particular domain name. Of course, it's also interesting to know what other host names may have resolved to

a particular IP address at a time.

Now, I'm not aware of a great free resource to look at that.

Passive Total does provide some of that, and then there are some commercial resources that will give you data

feeds. Problem in part is that this is fairly massive data and of course it's not easy to offer

that for free. And well, if you ever signed up for a service like Slack, then one of the ways how you can sort of limit who can sign up for a particular team is that these users have to have an account at your domain.

There's not an interesting blog post at freecodecamp.org that shows how to bypass this type of

authentication. So the requirement here is that you do have an email address at a particular domain,

let's say at example.com. The trick here is that you find something like a customer support email system

that dynamically creates example.com email addresses. Typically, you have something like ticket number

at example.com and you're being copied on all of these emails. Now, the system, and let's take Slack as an example here,

in order to prove that you have an account at the particular domain,

will just send a confirmation code to an email address that you provide.

So what you do is you open a support ticket at the particular website, then you

...