Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Question for DNS pros
From: Nils Ketelsen <nils () druecke strg-alt-entf org>
Date: Fri, 23 Jul 2004 22:32:46 +0200

On Fri, Jul 23, 2004 at 12:32:28PM -0500, Paul Schmehl wrote:
Can this be done?

1) You know an IP address that is running a DNS server.  (IOW, it responds 
to digs.)
2) You do not know the hostname or domain of the host.
3) The DNS server does not allow zone transfers.

You want to find out *all* the domains that that DNS server is 
authoritative for.  (Essentially you're trying to find out what's in the 
named.conf file rather than zone file info.)

Florian Weimer has an interesting project for exactly that. By analyzing all
request and replies to a resolver and writing the results into a database he
gets a system to allow this kind of inverse-queries (I avoid using the term
reverse queries because of the confusion this might cause with reverse

Basically this allows you to say "for what hosts did I get replies from the
nameser xyz?". This does not give you all zones of the nameserver, but only
those which at least were requested once by the resolver you are looking at.
Given enough resolvers gathering this data this might allow a fairly big
overview though. 

I do not know wether is tool is available to the public yet, though. Maybe
he can say something about it (Florian is also reading here). I have not yet
figured out, what I might use this tool for, but I think it will allow for
interesting things regarding filtering solutions. And it is a nice hack.

Gibt's eigentlich auch schon emacs-Einbauk├╝chen?

[nico.hoffmann () physik tu-chemnitz de (Nico Hoffmann)
zum Thema "vi-Tassen" in de.alt.arnooo]

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]