I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution for that, so, is there other way for an attacker to obtain that info if the Zone Tranfer is not allowed??

  • As written, this is incredibly broad. The ways to enumerate a network are as varied as the protocols the network supports. Also - we're getting into the realm of hacking that needs to be fairly well-tuned according our site guidelines. – bethlakshmi Jul 25 '13 at 15:31

From a DNS perspective, if Zone Transfers are not allowed the main ways to get similar information (i.e. information about valid hosts in the domain) would be either reconnaissance in search engines or using brute-force attacks to guess valid host names.

The search engine piece is relatively self explanatory. You search for information relating to the target organisation and see what hosts names are exposed. This kind of research can be automated using tools like Maltego (although this is only a small subset of its' functionality).

The DNS brute-force option essentially just guesses common host names against the target domain name. Again there are existing security testing tools which can automate this process for example the dns-brute plugin for nmap

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.