{"id":159,"date":"2023-03-03T22:08:44","date_gmt":"2023-03-03T22:08:44","guid":{"rendered":"https:\/\/merrillnewman.tech\/?p=159"},"modified":"2023-03-06T21:17:29","modified_gmt":"2023-03-06T21:17:29","slug":"dns-zone-transfers","status":"publish","type":"post","link":"https:\/\/merrillnewman.tech\/?p=159","title":{"rendered":"DNS Zone Transfers"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Overview<\/h3>\n\n\n\n<p>DNS zone transfers can give an attacker the keys to the DNS castle so to speak. Although this vulnerability is ancient and rather rare these days it is still important to know how zone transfers work and how to prevent unauthorized transfers.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h3 class=\"wp-block-heading\">What Is A Zone Transfer?<\/h3>\n\n\n\n<p>In simplest terms a zone transfer is the processes of copying a zone file onto another DNS server. Since DNS failure can have severe consequences for an organization, there are almost always multiple name servers with an identical zone file. DNS entries are generally only modified on the primary server. The secondary servers then synchronize with this primary server. The one serving as the source for the synchronization of a zone file is called a master and the one obtaining the zone data is called a slave. The slave fetches the SOA record from the master at certain intervals and compares serial numbers, if the serial number of the master is greater than the slaves, the data no longer matches and a zone transfer is initiated.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How To Perform a Zone Transfer<\/h3>\n\n\n\n<p>The process for performing a zone transfer with dig would like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dig ns example.com\ndig axfr example.com @ns.example.com<\/code><\/pre>\n\n\n\n<p>Here is an example:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"693\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1024x693.png\" alt=\"\" class=\"wp-image-160\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1024x693.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-300x203.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-768x520.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image.png 1250w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Getting the FQDN of the name server via the NS record<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"656\" src=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-1024x656.png\" alt=\"\" class=\"wp-image-161\" srcset=\"https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-1024x656.png 1024w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-300x192.png 300w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-768x492.png 768w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-1536x984.png 1536w, https:\/\/merrillnewman.tech\/wp-content\/uploads\/2023\/03\/image-1-2048x1313.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Performing a zone transfer with dig<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Impact Of Zone Transfers<\/h3>\n\n\n\n<p>While a zone transfer may not result in immediate compromise, it does grant someone a sizeable trove of information that can be used to launch other attacks. Generally speaking companies should only expose information that is necessary to provide the service they offer anything more is just unnecessary and makes an attackers life easier.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Remediation<\/h3>\n\n\n\n<p>Only allow transfers from trusted IPs. The exact steps to do this vary from server to server but there should be a way to whitelist your secondary servers for zone transfers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview DNS zone transfers can give an attacker the keys to the DNS castle so to speak. Although this vulnerability is ancient and rather rare these days it is still important to know how zone transfers work and how to prevent unauthorized transfers.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"hide_page_title":"","_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-159","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=159"}],"version-history":[{"count":3,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/159\/revisions"}],"predecessor-version":[{"id":165,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=\/wp\/v2\/posts\/159\/revisions\/165"}],"wp:attachment":[{"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merrillnewman.tech\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}