dig
dig asks a DNS server for records. A zone transfer can reveal hostnames in bulk when the server permits it. The supplied Red Block report uses this; a denied transfer is a normal access-control result.
Query deliberately
dig @192.0.2.10 example.test SOA +noall +answer
dig @192.0.2.10 example.test NS +noall +answer
dig @192.0.2.10 app.example.test A +noall +answer
dig @192.0.2.10 example.test AXFR +time=3 +tries=1@ selects the server, the next argument selects the name, and the final type selects the question. AXFR normally uses TCP: UDP DNS reachability does not establish that a transfer will work. Use the authoritative server and the exact zone, including a delegated child zone if one exists.
Interpret and validate
A completed AXFR contains the zone’s records and opening/closing SOA entries. REFUSED, an interrupted response, or a single ordinary lookup is not a completed transfer. Keep names with their record type and source. An A record is a discovery lead, not evidence of a vulnerable web application.
Success: an unauthorised client receives the intended zone contents. Restrict transfers to approved secondaries, preferably authenticated with TSIG. HTTP Host routing is a separate check: continue with wfuzz.
Record types worth asking for
| Type | What it helps establish | Follow-up |
|---|---|---|
SOA | Zone authority, serial and timing | Compare the same zone on each authoritative server |
NS | Servers responsible for a zone | Resolve each server and test it directly |
A / AAAA | IPv4 / IPv6 addresses | Keep both families in the service inventory |
CNAME | Alias to another name | Follow the canonical name without assuming ownership |
MX | Mail routing | Record priority and resolve the destination |
TXT | Text such as SPF and verification records | Treat text as configuration evidence |
SRV | Service name, port, priority and weight | Useful for AD DC and Kerberos discovery |
PTR | Reverse name for an address | Compare with forward resolution |
dig @192.0.2.10 example.test MX +noall +answer
dig @192.0.2.10 example.test TXT +noall +answer
dig @192.0.2.10 app.example.test AAAA +noall +answer
dig @192.0.2.10 _ldap._tcp.dc._msdcs.example.test SRV +noall +answer
dig @192.0.2.10 -x 192.0.2.20 +noall +answerANY is not a reliable replacement for these queries: servers can return a minimal response. An address or alias found through DNS still needs an in-scope service check.
Work a zone-transfer lead end to end
mkdir -p evidence/dns
dig @192.0.2.10 example.test SOA > evidence/dns/soa.txt
dig @192.0.2.10 example.test NS > evidence/dns/ns.txt
dig @192.0.2.10 example.test AXFR +time=3 +tries=1 \
> evidence/dns/axfr.txt 2>&1Use the full output for evidence; +short hides the status, server and authority details needed to explain a failure. Check whether the transfer starts and ends with the same SOA, then resolve selected names against that same server. If a child zone is delegated, query its authority rather than assuming the parent server holds it.
Compare UDP, TCP and recursive answers
dig @192.0.2.10 app.example.test A +time=2 +tries=1
dig @192.0.2.10 app.example.test A +tcp +time=2 +tries=1
dig @192.0.2.10 example.test SOA +norecurse| Observation | Interpretation | Next check |
|---|---|---|
NXDOMAIN | The queried name does not exist in that DNS view | Check spelling, suffix and selected server |
NOERROR, no answers | Name can exist without the requested type | Inspect authority and query another relevant type |
REFUSED | Server policy refused the request | Confirm authority and whether recursion or AXFR was requested |
SERVFAIL | Resolution or validation failed | Compare direct authoritative lookup and server logs |
| UDP times out, TCP works | Transport or response-size issue | Check filtering and truncation; retain both probes |
| Different internal/external answer | Split DNS, caching or different authority | Record server, timestamp and TTL for each view |
+trace follows public delegation and can contact many servers. It is usually unsuitable for private AD zones that exist only on the internal resolver.
Continue from names to services
Validate a discovered web name while keeping Host and TLS SNI aligned:
curl --resolve app.example.test:443:192.0.2.20 \
--cacert lab-ca.pem -I https://app.example.test/For AD, feed the DC FQDN and SRV results into LDAP Search; for HTTP catch-all routing use wfuzz. Keep a separate finding for an overly permissive AXFR and for any application issue discovered from its records.
Related learning
How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.