1. A tool for system administrators, dig sends DNS queries at the target server and decodes the replies. It is part of the BIND DNS server from the Internet Software Consortium. It is also popular with hackers because it allows fine-tuned queries to be crafted. Key point: Hackers like to run the following command in order to query the version of BIND: dig -t txt -c chaos VERSION.BIND @ns1.example.com The BIND server supports a kludge whereby a "chaos" "txt" record contains the version number of the server. You can look this up in your script-kiddy version list in order to figure out what scripts this server is vulnerable to. Here are some results I get back from this command: 4.9.6-REL RedHat 5.0 (Hurricane) 8.2.1 Mandrake 6.1 (Helios) SERVFAIL Solaris 2.6 NOTIMP WinNT DNS 8.2.2-P5 RedHat 6.2 A result of "SERVFAIL" means either that the target isn't running BIND, or that it is running a version of BIND older than 4.9.5. The result of "NOTIMP" means the server doesn't implement this type of query, which is returned by Microsoft's server. See also: DNS, BIND. From Hacking-Lexicon