Often times, administrators and default installations of various DNS servers (on all platforms) leave the DNS server susceptible to zone transfers. What this basically means is that the DNS server will allow someone to download a dump of all DNS records served for a specific domain. This can obviously pose a moderate to high security risk (but can be disabled on the server quite easily).

The information gained with a successful zone transfer can be very helpful for an intelligence gathering attacker and can ultimately expose the addresses of a huge number of hosts that administrators might not want the public (internet) to know about (and that no one planned to be exposed to internet traffic!).

For example, I have seen zone transfers that listed multiple development servers that were freely accessible, exposing security flaws due to incomplete code. Development boxes are also a good candidate to look for files with incorrect permissions to gain even more information out of the host.

Also, bare in mind the situation where someone gets their hands on a decent sized transfer. Thousands of hosts belonging to a single domain can be easily gleaned in seconds. I think it is also neat how you can quickly read over most zone transfers and easily pick out the devices that belong to the core infrastructure and even addresses of important services used in the domain (due to the verbosity some administrators use in coming up with a hostname).

I wrote a small Perl tool, dig-shovel, to automate the process of finding the list of nameservers for a domain, attempting a domain transfer from each, and finally parsing the addresses contained in the zone transfer into something easily readable and exportable. The tool I wrote can be directly downloaded form this site by with this link (right-click, Save As...) or click through to this post to get the details on dig-shovel.

Zone Transfer Example

The following is an example of a typical zone transfer using the free open source tool dig. This tool is available on most operating systems, though some you might have to hunt for the packages for your specific package manager. More information on manually using dig can be found here.

The dig-shovel Process

The manual process of this program would be as follows:

1. dig NS domain.tld    to get the initial nameservers we can attempt a zone transfer from
2. dig @nameserver axfr domain.tld    for each nameserver found in the previous step. (This manually attempts to do a zone transfer)
3. parse all the data into something easily readable

The dig-shovel program automates the process of diging up the nameserers, attempting a zone transfer from each, and finally tidies up the raw output of the zone transfer originally parsed by dig. I have also included a few simple logging facilities to either give you a total list of found hosts line-by-line or specifiy a user delimited, single line of found hosts. I figured someone might be interested in these export features to make it easy extend the list of hosts to another program.

Dependencies

Note that the following is for a Unix like operating system (Linux, BSD, etc, etc), but using it on Windows is just as possible. Hopefully I will get those directions on here as well.

To gain a little more control over Perl's form function, I overloaded it with the Perl6::Form module. Usually, your package manager will have the as a package. You are welcome to search for it, but the following are generic directions that can be used across nearly any platform with Perl already installed.

Again, Linux people might want to use wget instead of fetch here.

• $ mkdir /tmp/perl6_form
• # cd /tmp/perl6_form
• $ fetch http://search.cpan.org/CPAN/authors/id/D/DC/DCONWAY/Perl6-Form-0.04.tar.gz
• $ tar xvzf Perl6-Form-0.04.tar.gz
• $ cd Perl6-Form-0.04
• $ ls
• Changes    Form.pm    MANIFEST    Makefile.PL    README   demo   t
• $ perl Makefile.pl
• $ make test
• $ su root
• Password:
• $ make install

Using dig-shovel

If you have not already downloaded the dig-shovel.pl file, do it now by right-clicking on this link and use Save As... to save the file to your system.

Note that I used fetch to get the file via command line. All you Linux folk would most likely use wget here... although you can install fetch...

• $ ./dig-shovel.pl -d example.com -e hosts_lined -f output.txt -o ips
• ... ... snip ... snip ... ...
• $ cat output.txt
• 10.10.14.201
• 10.10.14.200
• 10.10.14.210
• 10.12.5.12
• 2001:9999:238::1:1
• 2001:9999:238::2:1

• $ ./dig-shovel.pl -d example.com -e hosts_delimit -f output.txt
• ... ... snip ... snip ... ...
• $ cat output.txt
• exampleinc.com,mail.exampleinc.com,mx01.exampleinc.com