Security Learning: How to Obtain the Version Information of the DNS Server

 Send the following request to a DNS server to get version information

% dig txt chaos VERSION.BIND @ns1.cxxxxxxxxx.com
It returns the following information:

; <<>> DiG 9.10.6 <<>> txt chaos VERSION.BIND @ns1.xxxxxxxxx.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54602
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;VERSION.BIND.          CH  TXT

;; ANSWER SECTION:
VERSION.BIND.       0   CH  TXT "9.11.3-1ubuntu1.15-Ubuntu"

;; AUTHORITY SECTION:
version.bind.       0   CH  NS  version.bind.

;; Query time: 18 msec
;; SERVER: 1.2.3.4#53(1.2.3.4)
;; WHEN: Sun May 15 16:58:41 CST 2022
;; MSG SIZE  rcvd: 105

For security reasons, the version information needs to be modified. In BIND, you can use the version command to modify version information. If your BIND version is old and there are some known bugs or bugs that have been discovered by hackers, they will launch an attack against the BIND version number after they obtain the BIND version number through version.bind, hiding your BIND version information. , which protects your DNS server from hackers exploiting the BIND vulnerability.

option {
    #...
    version "I don't tell you my version.";
    #...
};