Re: DNS zone transfer

From: Eric Monti (EMON44@CBOT.COM)
Date: 06/10/02


Date: Mon, 10 Jun 2002 09:05:35 -0500
From: "Eric Monti" <EMON44@CBOT.COM>
To: <progman@netvision.net.il>, <vuln-dev@securityfocus.com>


I dont think there is a mechanism in most DNS server implementations to quickly find out all the domains it's authoritative/secondary for. But might it be possible to acheive the same effect using some creative whois queries against domain registries?

What I'm thinking about is that usually (not always) the registry assigns a handle to DNS servers when they are included/added as servers for domains. Does anyone know if there is a way to query for all domains served by a given DNS server's handle?

-e

>>> Vlad <progman@netvision.net.il> 06/08/02 09:00AM >>>
Greetings,

Is it possible to remotely retrieve all DNS records from a server
*without* knowing the specific zones it hosts?
(cause then I can script "dig @dns-server.ip zone-domain ALL" )

If it matters the server runs the DNS service on Win2k and I've got no
preferance for Windows or *NIX tools. Any will do.

Thanks,
 - Vlad.