Dark Mode
Capec-290 Detail
Enumerate Mail Exchange (MX) Records
Detailed Software Typical Severity: Low
Parents: 309
Threats: T60 T65 T80 T258 T288 T291 T302 T334 T392 T407
An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-290 | capec | https://capec.mitre.org/data/definitions/290.html | |
| CWE-200 | cwe | http://cwe.mitre.org/data/definitions/200.html | |
| REF-33 | reference_from_CAPEC | Stuart McClure, Joel Scambray, George Kurtz, Hacking Exposed: Network Security Secrets & Solutions (6th Edition), 2009, McGraw Hill |
Not present
- The adversary requires access to a DNS server that will return the MX records for a network.
- A command-line utility or other application capable of sending requests to the DNS server is necessary.
Not present
| Authorization | Access Control | Confidentiality |
|---|---|---|
| Bypass Protection Mechanism | Bypass Protection Mechanism | Other |
| Hide Activities | Hide Activities | Bypass Protection Mechanism |
| Hide Activities |
Not present