While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this information.

  • Where did you see this claim? – Mark May 31 '14 at 4:15
  • Well, I assume that NSEC3 switched to using hashes for a good reason. Unless there is some other reason they did it? – Merlin May 31 '14 at 4:16

This isn't about a specific attack. Before an attack, there is usually thorough information gathering about a target. This is where the insecurity exists.

Vulnerable systems on a network are vulnerable whether you have the domain or not. It's a matter of having a list of nodes with often times verbose naming conventions that give away more information then is needed.

It can provide information on network design, location of devices, types of devices, and much more. It doesn't need to be used in a cyber attack either, this type of information could prove valuable in a social engineering attack.

When this type of information used to be widely available, doing a host -l was a standard step in surveying a target. That has since changed and we shouldn't take steps backwards. There is no reason this information should be disclosed to the public internet.

  • How has it "changed"? Why wouldn't host -l work presently? – Pacerier May 25 '15 at 3:51
  • host -l uses a zone transfer to enumerate all sub domains. Most DNS resolvers now deny this behavior by default, such as with Bind's allow-transfer. – David Houde May 26 '15 at 20:18
  • So what other ways are there to get the list of subdomains besides bruteforcing? – Pacerier Jul 2 '15 at 16:21
  • A zone transfer is the only guaranteed way to get a complete list of records. You can effectively zone walk if the server has DNSSEC enabled with NSEC (rather than using NSEC3, which was implemented specifically to prevent it). – DoubleD Dec 17 '18 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.