I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution for that, so, is there other way for an attacker to obtain that info if the Zone Tranfer is not allowed??
closed as too broad by bethlakshmi, TildalWave, Xander, Lucas Kauffman, rook Jul 25 '13 at 20:52
There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.
From a DNS perspective, if Zone Transfers are not allowed the main ways to get similar information (i.e. information about valid hosts in the domain) would be either reconnaissance in search engines or using brute-force attacks to guess valid host names.
The search engine piece is relatively self explanatory. You search for information relating to the target organisation and see what hosts names are exposed. This kind of research can be automated using tools like Maltego (although this is only a small subset of its' functionality).
The DNS brute-force option essentially just guesses common host names against the target domain name. Again there are existing security testing tools which can automate this process for example the dns-brute plugin for nmap