Enumerate a zone you host, and try to transfer it

short · 50 min · Objective 2.2

Task

Stand up a DNS zone on your own lab, enumerate what its records disclose, and attempt a zone transfer against it — both misconfigured and fixed — so you can see the single highest-yield DNS mistake happen and then close it.

Steps

  1. On a VM on the lab network you own, configure an authoritative zone for a made-up domain such as corp.lab, with a handful of records: A, CNAME to a pretend cloud alias, MX, TXT with a sender policy, and an internal-only name.
  2. First, deliberately allow zone transfer to any host.
  3. From the attacker VM, request the full zone transfer and save it to /tmp/zone.txt. Note that you received every name at once, including the internal-only one.
  4. Now restrict transfer to secondaries only, reload, and request it again — it should be refused.
  5. With transfer refused, enumerate names the other way: query each record type directly, and note what TXT alone discloses about the SaaS estate.
  6. Record which names would need resolving to addresses and confirming for ownership before any of them could be a target.

Verify

grep -cE "IN\s+(A|CNAME|MX|TXT)\b" /tmp/zone.txt
grep -ciE "internal|priv|admin" /tmp/zone.txt
dig @127.0.0.1 corp.lab AXFR 2>/dev/null | grep -c "Transfer failed" || echo "check restricted result by hand"

The first count must be non-zero: the unrestricted transfer handed over the whole zone. The second must be non-zero: the internal-only name came across too, which is exactly why an open transfer is the highest-yield DNS misconfiguration. The third confirms the fix — after restriction, the transfer is refused, and enumeration has to fall back to per-record queries.

Notes

Try the transfer against every authoritative server, not just the first — the restriction is per-server, and an estate is only as closed as its most forgotten secondary. A private address returned in a public zone is information disclosure, not nothing; a record pointing at a released cloud address is a takeover risk. Everything here ran against a zone you host, so no real domain was touched.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.