COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-290

Enumerate Mail Exchange (MX) Records

An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.

Requirements

What does the attack require?

Prerequisites

  • The adversary requires access to a DNS server that will return the MX records for a network.

Skills required

Not stated in the MITRE record.

Resources required

  • A command-line utility or other application capable of sending requests to the DNS server is necessary.

Impact

What does a successful attack lead to?

Other

Affected scopes: Confidentiality

Bypass Protection MechanismHide Activities

Affected scopes: Confidentiality, Access Control, Authorization

CAPEC-290: Enumerate Mail Exchange (MX) Records — DayBreach Saldırı Sözlüğü · DayBreach