32

Can anyone explain what is DNS zone transfer attack or give any link, paper?

I have already googled, but could not find anything meaningful.

Improve this question

2 Answers 2

Reset to default
55

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (which is called a "zone") to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Primary DNS server, and one or more Secondary DNS servers, and the secondaries ask the primary for a copy of the records for that zone.

A basic DNS Zone Transfer Attack isn't very fancy: you just pretend you are a secondary and ask the primary for a copy of the zone records. And it sends you them; DNS is one of those really old-school Internet protocols that was designed when everyone on the Internet literally knew everyone else's name and address, and so servers trusted each other implicitly.

It's worth stopping zone transfer attacks, as a copy of your DNS zone may reveal a lot of topological information about your internal network. In particular, if someone plans to subvert your DNS, by poisoning or spoofing it, for example, they'll find having a copy of the real data very useful.

So best practice is to restrict Zone transfers. At the bare minimum, you tell the primary what the IP addresses of the secondaries are and not to transfer to anyone else. In more sophisticated set-ups, you sign the transfers. So the more sophisticated zone transfer attacks try and get round these controls.

SANS have a white paper that discusses this further.

Improve this answer
2
  • Is there a pubic list of DNS slaves?
    – Lucian Nitescu
    Commented Nov 3, 2016 at 14:40
  • @dvvcnxc Not really a list, although you could make a decent guess of which server is the primary and which are the secondaries from the results of SOA and NS queries against the domain.
    – Graham Hill
    Commented Mar 2, 2021 at 9:36
22

@GrahamHill already explained a zone transfer pretty good already, but I'll try to fill in some more.

By being able to query for all records from the DNS server, the attacker can easily determine which machines are accessible. The zone transfer may reveal network elements that are accessible from the Internet, but that a search engine like Google (site:.target.) does not pick up. Lesson here is that you don't want to let the bad guys have the information for free! They should have to work as hard as possible for it...

An interesting fact about DNS zone transfers is that they usually rely on TCP port 53 instead of UDP port 53. If you see TCP port 53 in use, it could tell you that someone is doing a zone transfer.

To actually complete a zone transfer on a vulnerable DNS server you could issue these commands:

Windows:

nslookup
> server <DNS you are querying>
> set type=any
> ls -d <target>

Unix (nslookup is deprecated on Unix): 

dig -axfr @<DNS you are querying> <target>

DigiNinja has a very good tutorial/explanation on how zone transfers work and why they should be restricted. Check out zonetransferme .

Improve this answer
5
  • 1
    Hmm, am I doing this wrongly? nslookup on Windows ls -d [x].[x].[x].[x]: The DNS server refused to transfer the zone [x].[x].[x].[x] to your computer. If this is incorrect, check the zone transfer security settings for [x].[x].[x].[x] on the DNS server at IP address 8.8.8.8. ....
    – Pacerier
    Commented Feb 16, 2016 at 17:06
  • 3
    @pacerier this means that zone transferring is locked down to a limited set of IP addresses, most likely DNS servers.
    – Chris Dale
    Commented Feb 16, 2016 at 17:08
  • Many DNS servers nowadays also support query over TCP on port 53 for either larger response or DNSSEC. serverfault.com/questions/181956/…
    – Jay
    Commented Aug 25, 2018 at 23:52
  • "An interesting fact about DNS zone transfers is that they usually rely on TCP port 53 instead of UDP port 53. " No, not usually. RFC1034 §4.3.5 "Because accuracy is essential, TCP or some other reliable protocol must be used for AXFR requests."
    – Patrick Mevzek
    Commented Sep 4, 2023 at 18:52
  • @Jay Not "nowadays". DNS was always, since 40 years ago, defined to work over both UDP and TCP for all queries (except AXFR). That is, a nameserver replying over UDP but not replying over TCP is FULLY NON-CONFORMING to specifications.
    – Patrick Mevzek
    Commented Sep 4, 2023 at 18:53

You must log in to answer this question.