Re: anonymous Zonetransfer (AXFR) exploatation
- From: krymson@xxxxxxxxx
- Date: 20 Mar 2008 19:05:38 -0000
Just to address this one aspect of the thread, there was a recent case in North Dakota, US which was presumed to have determined that a DNS zone transfer constituted hacking [1]. This wasn't the whole complaint or reason for the ruling, but that is the part that media and places like Slashdot picked up and highlighted. I know precedence is important in US law, but I'm not sure this would stand up upon further scrutiny.
Nonetheless, the real point is to limit zone transfers.
[1] http://www.theregister.co.uk/2008/01/17/anti_spam_activist_lawsuit/
<- snip ->
I never heard of laws that forbids you to get DNS content from a server. Maybe I am late with the news, but
as long as it is only an information disclosure it shouldnt be less legal than a port scan.
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
- Prev by Date: RE : Promiscuous Mode
- Next by Date: Re: Session Hijacking over HTTP
- Previous by thread: Re: anonymous Zonetransfer (AXFR) exploatation
- Next by thread: Inguma version 0.0.7.2 released
- Index(es):
Relevant Pages
|
|
