-: Continuing with our DNS theme,
we're gonna talk about DNS zone transfers.
Now, DNS zone transfers are an important concept
to understand, both from a security risk standpoint
and if you're gonna take the CSA+ exam,
because they like to ask questions on this.
DNS zone transfers are designed to replicate
DNS databases between two DNS servers.
So, if I'm hosting the DNS for jasondion.com,
well, other companies need to know
what IP addresses are associated with that,
and I do that through a zone transfer
from me to Google and me to Yahoo and me to MSN
and me to all the other companies out there.
Now, there's a vulnerability that was exploited here,
because the zone transfer, if it's allowed,
you can get all this data about that server
based on the zone transfer very quickly,
so most are gonna prevent zone transfers
to servers that aren't trusted,
and instead they have to do it to trusted servers first.
And now, if you find one that does allow a zone transfer
and you're doing a pen test,
this is a great time to take your data, right?
You can do this by using the command dig,
and you'll see here the command prompt,
I gave you the command: dig space axfr,
which stands for zone transfer, and then @ the dns server
that you're going to, domain.name, right?
So, it might be @dns-server jasondion.com, right?
Whatever it happens to be.
You would type that in and get that zone transfer.
It's a lot of data, but it will give you all the data
you want for all of those DNS records that that server
handles, which could be the company you're going after,
as well as hundreds or thousands of other ones.
Now, if you want to try performing
a zone transfer, you can.
There's a website out there called DigiNinja,
and it provides a couple of DNS servers
that are gonna allow zone transfers
for you to practice this technique
if you're trying to become a ethical hacker
or a pen tester, so if you want to do this,
you'll open up your Linux terminal
and try it by going against the nsztm1.digi.ninja,
and nsztm2.digi.ninja.
Both of those servers will allow a zone transfer
using the command I showed you on the last slide.
And I'll actually put this up as a lab
for you to try in the next lesson.
DNS brute forcing.
So, if you can't do a zone transfer, what do you do?
Well, you're gonna brute force the DNS,
and that simply means you're gonna send a lot of
manual requests to the DNS server
to find the IP for the organization.
Now, you can do this as a script,
using something like Python or Shell,
or you can do this manually by sitting at the keyboard
and typing it out each and every time.
Organizations can protect against this, though,
by sending the responses much more slowly
by using IDS or IPS rules to prevent it, or the server
sending it to the response time to be very slow.
Why do we do this?
Well, if I'm gonna learn a script
and I can ask a hundred different IP questions
in the matter of a minute,
I get a lot of information very quickly.
If you set it so that hey, you can only ask
one question per minute, it's now gonna take me
a hundred minutes or a little over an hour and a half
to get the information I wanted.
If I said one per every 10 minutes,
it can take a lot longer, right?
So, you can see why it's gonna slow down the attacker
and make them go a different way.
You want to try to prevent the attackers from getting in.
You want to prevent them from getting any information
about you, and again, this is all part
of the reconnaissance phase for them.
It's finding our your IP addresses.
It's finding out where your organization sits.
It's finding out all of that information,
and you want to prevent that as best as possible
by disabling zone transfers
and by slowing down those brute force attacks.
(logo buzzes)