Question
A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?
- A. dig +short A AAAA local.domain
- B. nslookup local.domain
- C. dig axfr @local.dns.server Correct
- D. nslookup -server local.dns.server local.domain *
Explanation
A zone transfer (AXFR, defined in RFC 5936) asks the DNS server for a full copy of the zone, returning every record in the domain at once, and dig requests one with the axfr query type against a chosen server. dig +short A AAAA returns only the address records for a single name. nslookup local.domain resolves just that one name. The nslookup command with a wildcard is not valid syntax for listing a whole zone.
