And this video I'll discuss another type of attack on VNS called DNS is on transfer.
It is actually an application process between two servers master server and a slave server and where
these leave server requests a copy of the zone file from the master server and depending on the configuration
of the master server it transfer might take place or not.
Looking at the screen you can see that zone transfer is configured to take place only to the following
server with its IP address in this configuration you can might take place if you select any server thus
anyone requesting the zone file will be able to get.
Unfortunately some companies they mis configure their internal and external DNS names faces so that
if you if this is mis configured on this DNS server and you request zone transfer you live it to get
a full map of the network.
Thus it's a very important piece of information to start with the network attack the information that
might be revealed from a US attack or DNS to consents are these types of records sort of authority Name
Server any hosts on configured on the DNS economic names.
Pointers Amex records etc. So having this information is actually very important.
Before starting any type of attack so let's go Daddy key to our candy machine here and do a live example.
I'll use a tool called DNS recon which is an advanced Dennis emulation script.
It is written in Python and it's mainly used for DNS reconnaissance.
It can intimidate the NSA records it can perform the zone transfer and it can perform as well reverse
lookups you can invoke it by typing d and s that it can and you can type help you'll be able to get
all the help needed to invoke this script such as the minus n refers to invoking or mentioning the name
server or providing a range of eyepiece to do the vertical cups.
D is to provide a file with all the domains and sub domains of host names.
What.
Another important param did he is the aim is to perform a excel form.
Standard information actually is to perform the zone transfer Excel fast sense for a query for his own
transfer.
Let's go directly to two example here use D and ask where Khan and the minus D parameter stands for
Domain.
I'll use a domain called Zone transfer.
That's me and invoke it.
So here you can see that it's performing the DNS reconnaissance.
It gets all the information about the SLA attacker.
The name servers the emacs records all of this information as well as the X record which is actually
mainly used to preserve the originality of sending emails and the privacy of your domain to a further
example here by using the minus a parameter which is perform zone transfer to the same domain.
As you can see here you'll see some time but actually you can see that zone transfer has been done successfully.
OK it's over.
So let's go back to the beginning of this script here.
So now it revealed the asshole attacker the name server records so it actually revealed to name servers.
What this script will do is actually to loop to loop through these named servers and get all the records
associated with the name server.
So we hear it.
It's strange.
Name Server the first name server and this is all information associated going further.
This is the second name server and this is all information of the records as well.
So happy enumerating.