DNS Zone Transfer
DNS zone
A DNS namespace can be divided into multiple zones storing information about one or more DNS domains For each domain name in a zone, the zone is the authoritative source of information about that domain
Finding a DNS zone transfer vulnerability
Running nmap and finding port 53 open suggests a zone transfer could be attempted (most should fail)
Tools to automate DNS zone transfer
Sam Spade, axfr, dig
Why have DNS zone transfers
They are required to replicate and synchronise all copies of the zone used at each server configured to host the zone
Why have DNS zones
They provide availability and fault tolerance when resolving name queries
What is a zone transfer
Type of DNS transaction used to replicate DNS databases across a set of DNS servers
Executing a DNS zone transfer vulnerability
host -t ns example.com (find DNS servers for the domain) host -l example.com example2.com (pick one, and request a transfer) This will allow access to records stored on the DNS server