Port 53 – DNS (Domain Name System)

Why It’s Open

Port 53 is essential for DNS resolution. It may be open on public DNS resolvers or internal DNS servers. TCP is typically used for zone transfers and large responses.

Common Risks

DNS Amplification: Used in reflection-based DDoS attacks.
Zone Transfer (AXFR) Enabled: Can leak entire DNS database.
Cache Poisoning: Older configurations can be manipulated.
Information Disclosure: May reveal internal hosts/subdomains.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Enumeration & Testing

Basic check

nmap -sU -p 53
nmap -sU -p 53 --script=dns-recursion

Zone transfer test

dig @ example.com
dig axfr @ example.com

DNS version disclosure

dig @ CHAOS TXT version.bind

What to Look For

Checkpoint	What it means
Zone transfer allowed	Leaks internal DNS records
Public resolver	Can be abused for DDoS
Version info exposed	Easier to target known vulnerabilities

Known Exploits

CVE-2015-5477

A flaw in ISC BIND allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via specially crafted TKEY queries.

🔗 NVD Entry

🔗 Red Hat Advisory

Mitigation

Disable zone transfers unless needed; restrict with allow-transfer.
Rate-limit DNS responses.
Hide version info with version "not disclosed"; in BIND.
Use DNSSEC where appropriate.

Real-Life Example

Large DNS amplification attacks have used open resolvers to generate massive traffic floods. Insecure configurations continue to be exploited.

TL;DR

Service: DNS (Domain Name System)
Default Port: 53/TCP and UDP
Risks: Denial of service, cache poisoning
Mitigation: Apply patches, restrict recursion, monitor DNS traffic