Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What information will the axfr and ixfr commands in DIG provide to an attacker?

share|improve this question
    
Interesting question. Perhaps, there should be a tag for "interview-questions" in this QnA. –  KarmicDice Sep 1 '12 at 7:13
    
btw... nice handle, reminds me of me :D –  KarmicDice Sep 1 '12 at 7:19
    
I have tried to fix the question. It wasn't a good security question previously, and I nearly closed as off topic. –  Rory Alsop Sep 1 '12 at 12:14
2  
@RoryAlsop this user is simply copy-pasting questions from certification exams. This one is question 2 from this exam –  tylerl Sep 2 '12 at 6:56
    
@tylerl - yes they have been warned and given a temporary suspension. Thanks. –  Rory Alsop Sep 2 '12 at 9:48
add comment

2 Answers

AXFR is the traditional way of zone transferring - you just completely copy the dns records from one zone to the other - an attacker will have a complete list of resources in the organizations and if you save some more information on those servers on your nameserver it will be included

IXFR on the other hand helps sysadmins in replicating an already given zone that was doing a complete AXFR in the past and need to be updated to the latest record revision on the nameserver, without the hassle and band-choking of a complete copy of records. in IXFR you can select the revision that you have and the server will provide you with the updated data since your revision, to an attacker is the same as before - just less information.

share|improve this answer
add comment

She wants to download the zone and discover the list of the machines with ip numbers she can access. This way, I just download the zone, and all the server names and it's ip numbers are revealed, so I look upon systems to which I can have access and I can try my login / password.

Easy way to accomplish this:

host -a -l example.com

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.