Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution for that, so, is there other way for an attacker to obtain that info if the Zone Tranfer is not allowed??

share|improve this question

closed as too broad by bethlakshmi, TildalWave, Xander, Lucas Kauffman, rook Jul 25 '13 at 20:52

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

As written, this is incredibly broad. The ways to enumerate a network are as varied as the protocols the network supports. Also - we're getting into the realm of hacking that needs to be fairly well-tuned according our site guidelines. – bethlakshmi Jul 25 '13 at 15:31

From a DNS perspective, if Zone Transfers are not allowed the main ways to get similar information (i.e. information about valid hosts in the domain) would be either reconnaissance in search engines or using brute-force attacks to guess valid host names.

The search engine piece is relatively self explanatory. You search for information relating to the target organisation and see what hosts names are exposed. This kind of research can be automated using tools like Maltego (although this is only a small subset of its' functionality).

The DNS brute-force option essentially just guesses common host names against the target domain name. Again there are existing security testing tools which can automate this process for example the dns-brute plugin for nmap

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.