DNS domain transfer vulnerability exploitation and repair notes

I. Title: DNS domain transfer vulnerability exploitation and repair

 

Ii. DNS domain transfer and utilization

2.1 use the BT5 tool to obtain DNS information

 

# Cd/pentest/enumeration/dns/dnsenum

#./Dnsenum. pl -- enum domain.com (you can omit -- enum. Note the distinction between the host name and domain name)

 

Domain names can also be recorded under each Domain name, and the complete host name (FQDN) is combined ). Host Name Fully Qualified Domain Name

FQDN (Domain name & Hostname) = www.ksu.edu.tw

Domain name = ksu.edu.tw

Hostname = www

Therefore, pay attention to the Domain name ---> domain.com [NOTE 1].

[NOTE 2 the link is very detailed]

Dnsmap is also available. For more information, see note 2.

E.g.: // example

#./Dnsmap target-domain.foo

 

 

2.2 General Method

It is recommended to use a manual method. The method is as follows:

> Nslookup

> Set type = ns

> Domain.com

> Server nsXXXXX.com (according to nameserver)

> Ls domain.com

 

Use the following command in 189store.com.txt to check the query result

 

 

III,Solution:

Ns1.okbuy.com (123.103.16.20.) and ns2.okbuy.com (123.103.16.132)

There is no access control definition ACL (Access Control List) to restrict cross-region transfer between domain name servers.

Edit/etc/named. conf

Set in zone configuration of okbuy.com

Allow-transfer {localhost; 123.103.16.133 ;};

Or

Allow-transfer {localhost; 123.103.16.132 ;};

 

Iv. Safe

4.1. Dns Security Policy,4.1.1 isolate the DNS server, and use the backup Domain Name Server 4.1.2 to hide the bind version 4.1.3. 4.1.4Chroot bind

4.1.5 prohibit regional transfer

Theoretical Explanation [NOTE 3]

 

4.2. DNS security tools

4.2.1 DNS Flood Detector

4.2.2 DNSSEC

4.2.3 DNSTOP

 

4.6,ExtensionDNS-iptables Port

# Grep domain/etc/services Query the port opened by dns

Iptables DNS port settings.

 

V. Reference Sources

Note 1: http://www.centos.bz/manual/vbird/linux_server/0350dns.php#theory

NOTE 2: BT4 Reading Notes (Chapter 4 dns information collection based on information gathering)

Http://www.bkjia.com/Article/201211/167664.html

NOTE 3: DNS domain transfer leakage vulnerability details http://www.bkjia.com/Article/201202/118349.html