DNS区域传输、DNS字典爆破、DNS注册信息

我们可以利用DNS区域传输来查看目标的记录,首先我们要先知道一个域名服务器,因为域名服务器有所有主机的记录,dig @域名服务器 域 传输方法axfr(AXFR请求,是从DNS服务器请求在主DNS服务器上更新信息的一类域名系统的请求。)

我们先挑选一个ns记录,来进行区域传输;

root@kali:~# dig @ns2.sina.com sina.com axfr
;; Connection to 114.134.80.145#53(114.134.80.145) for sina.com failed: connection refused.

尝试连接53端口,连接被拒绝;换一个

root@kali:~# dig @ns4.sina.com sina.com axfr

; <<>> DiG 9.9.5-9+deb8u3-Debian <<>> @ns4.sina.com sina.com axfr
; (1 server found)
;; global options: +cmd
; Transfer failed.

失败

dns是基于UDP,TCP的53端口的(其实当解析器发出一个request后,返回的response中的tc删节标志比特位被置1时,说明反馈报文因为超长而有删节。这是因为UDP的报文最大长度为512字节。解析器发现后,将使用TCP重发request,TCP允许报文长度超过512字节。既然TCP能将data stream分成多个segment,它就能用更多的segment来传送任意长度的数据。

另外一种情况是,当一个域的辅助域名服务器启动时,将从该域的主域名服务器primary DNS server执行区域传送。除此之外,辅域名服务器也会定时(一般时3小时)向PDS进行查询以便了解SOA的数据是否有变动。如有变动,也会执行一次区域传送。区域传送将使用TCP而不是UDP,因为传送的数据量比一个request或response多得多。)

[email protected]:~# host -h
host: illegal option -- h
Usage: host [-aCdlriTwv] [-c class] [-N ndots] [-t type] [-W time]
            [-R number] [-m flag] hostname [server]
       -a is equivalent to -v -t ANY
       -c specifies query class for non-IN data
       -C compares SOA records on authoritative nameservers
       -d is equivalent to -v
       -l lists all hosts in a domain, using AXFR
       -i IP6.INT reverse lookups
       -N changes the number of dots allowed before root lookup is done
       -r disables recursive processing
       -R specifies number of retries for UDP packets
       -s a SERVFAIL response should stop query
       -t specifies the query type
       -T enables TCP/IP mode
       -v enables verbose output
       -w specifies to wait forever for a reply
       -W specifies how long to wait for a reply
       -4 use IPv4 query transport only
       -6 use IPv6 query transport only
       -m set memory debugging flag (trace|record|usage)

[email protected]:~# man host            //查看该命令的基础用法

[email protected]:~# info host           //查看该命令的基础用法
[email protected]:~# host -T -l sina.com 8.8.8.8 ns3.sina.com
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases: 

Host sina.com not found: 2(SERVFAIL)
; Transfer failed.

当我们不能进行区域传输时,我们可以使用字典爆破

[email protected]:~# fierce -dnsserver 8.8.8.8 -dns sina.com.cn wordlist a.txt /usr/share/fierce/hosts.txt
DNS Servers for sina.com.cn:
    ns3.sina.com.cn
    ns2.sina.com.cn
    ns4.sina.com.cn
    ns1.sina.com.cn

Trying zone transfer first...

Unsuccessful in zone transfer (it was worth a shot)
Okay, trying the good old fashioned way... brute force

Checking for wildcard DNS...
    ** Found 97704271057.sina.com.cn at 202.102.110.204.
    ** High probability of wildcard DNS.
Now performing 2280 test(s)...
123.125.29.250  8.sina.com.cn
58.63.236.239   a1.sina.com.cn
58.63.236.237   a1.sina.com.cn
58.63.236.230   a1.sina.com.cn
58.63.236.230   a2.sina.com.cn
58.63.236.239   a2.sina.com.cn
58.63.236.237   a2.sina.com.cn
58.63.236.248   ad.sina.com.cn
121.14.1.189    ad.sina.com.cn
121.14.1.190    ad.sina.com.cn
121.14.1.190    ads.sina.com.cn
……

可以看到是先查询了所有的ns记录,然后去axfr,这个程序自带字典,我们查一下

dpkg -L fierce

安装dnsdict6

wget http://www.thc.org/releases/thc-ipv6-2.7.tar.gz

使用上面的命令会出现证书错误,在本机下载然后拖进虚拟,最后打开终端开始安装!

tar zvxf thc-ipv6-2.7.tar.gz
cd thc-ipv6-2.7
sudo apt-get install libpcap-dev libssl-dev
make
sudo cp dnsdict6 /usr/bin/

用来枚举域服务器的,它使用你提供的一个字典或者内置的列表来枚举

语法:dnsdict6 [-d46] [-s|-m|-l|-x] [-t 并发线程] [-D] 域名 [字典路径]

参数说明:

-4 显示ipv4

-t 指定要使用的线程 默认:8 最大:32

-D =================[只显示字典不扫描]====

-d 显示在DNS服务器上的NS(一种服务记录类型)MX(邮件服务器) ipv6 的域名信息

-e 忽略没有NS域错误

-S 执行SRV服务名称猜测

-[smlx] 选择字典大小[内置的] -s 小型是50条 -m 中等是796条[默认] -l 大型1416条 -x 最大3211条 -u最大的字典

[email protected]:~# dnsdict6 -h
dnsdict6 v2.7 (c) 2014 by van Hauser / THC <[email protected]> www.thc.org

Syntax: dnsdict6 [-d4] [-s|-m|-l|-x|-u] [-t THREADS] [-D] domain [dictionary-file]

Enumerates a domain for DNS entries, it uses a dictionary file if supplied
or a built-in list otherwise. This tool is based on dnsmap by gnucitizen.org.

Options:
 -4      do also dump IPv4 addresses
 -t NO   specify the number of threads to use (default: 8, max: 32).
 -D      dump the selected built-in wordlist, no scanning.
 -d      display IPv6 information on NS and MX DNS domain information.
 -e      ignore no NS for domain errors
 -S      perform SRV service name guessing
 -[smlxu] choose the dictionary size by -s(mall=100), -m(edium=1419) (DEFAULT)
           -l(arge=2601), -x(treme=5886) or -u(ber=16724)
[email protected]:~# dnsdict6 -d4 -t 16 -x sina.com     //枚举域服务器,显示6行,线程16,最大,域名
Starting DNS enumeration work on sina.com. ...
Gathering NS and MX information...
NS of sina.com. is ns4.sina.com.cn => 121.14.1.22
NS of sina.com. is ns2.sina.com. => 114.134.80.145
NS of sina.com. is ns1.sina.com. => 114.134.80.144
NS of sina.com. is ns4.sina.com. => 123.125.29.29
NS of sina.com. is ns2.sina.com.cn => 61.172.201.254
NS of sina.com. is ns3.sina.com.cn => 123.125.29.99
NS of sina.com. is ns1.sina.com.cn => 202.106.184.166
NS of sina.com. is ns.sina.com. => 61.172.201.254
No IPv6 address for NS entries found in DNS for domain sina.com.
MX of sina.com is freemx2.sinamil.sina.com.cn => 218.30.115.106

个人感觉dnsdic16比较好用;

[email protected]:~# dnsenum -f dnsbig.txt -dnsserver 8.8.8.8 sina.com -o sina.xml
dnsenum.pl VERSION:1.2.3

-----   sina.com   -----

Host‘s addresses:
__________________

sina.com.                                47       IN    A        66.102.251.33

Name Servers:
______________

ns2.sina.com.cn.                         12328    IN    A        61.172.201.254
ns3.sina.com.cn.                         21599    IN    A        123.125.29.99
ns1.sina.com.cn.                         12449    IN    A        202.106.184.166
ns1.sina.com.                            21519    IN    A        114.134.80.144
ns3.sina.com.                            14250    IN    A        61.172.201.254
ns4.sina.com.                            20263    IN    A        123.125.29.99
ns2.sina.com.                            20931    IN    A        114.134.80.145
ns4.sina.com.cn.                         15452    IN    A        121.14.1.22

Mail (MX) Servers:
___________________

freemx2.sinamail.sina.com.cn.            167      IN    A        218.30.115.106
freemx3.sinamail.sina.com.cn.            1194     IN    A        60.28.2.248
freemx1.sinamail.sina.com.cn.            11       IN    A        202.108.3.242

Trying Zone Transfers and getting Bind Versions:
_________________________________________________

Trying Zone Transfer for sina.com on ns2.sina.com.cn ...
AXFR record query failed: connection failed

Trying Zone Transfer for sina.com on ns3.sina.com.cn ...
AXFR record query failed: RCODE from server: REFUSED

Trying Zone Transfer for sina.com on ns1.sina.com.cn ...
AXFR record query failed: connection failed

Trying Zone Transfer for sina.com on ns1.sina.com ...
AXFR record query failed: truncated zone transfer

Trying Zone Transfer for sina.com on ns3.sina.com ...
AXFR record query failed: connection failed

Trying Zone Transfer for sina.com on ns4.sina.com ...
AXFR record query failed: RCODE from server: REFUSED

Trying Zone Transfer for sina.com on ns2.sina.com ...
AXFR record query failed: connection failed

Trying Zone Transfer for sina.com on ns4.sina.com.cn ...
AXFR record query failed: connection failed

Brute forcing with dnsbig.txt:
_______________________________

Error: make sure that the file dnsbig.txt exists and has a size greater than zero.
[email protected]:~# dpkg -L dnsenum
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/dnsenum
/usr/share/doc/dnsenum/README.md
/usr/share/doc/dnsenum/copyright
/usr/share/doc/dnsenum/changelog.Debian.gz
/usr/share/dnsenum
/usr/share/dnsenum/dns.txt
/usr/bin
/usr/bin/dnsenum
[email protected]:~# dnsenum -f www -dnsserver 8.8.8.8 sina.com -o sina.xml
dnsenum.pl VERSION:1.2.3

-----   sina.com   -----

Host‘s addresses:
__________________

sina.com.                                14       IN    A        66.102.251.33

Name Servers:
______________

ns3.sina.com.cn                               13896     IN     A        123.125.29.99
ns1.sina.com                                  7721      IN     A        202.106.184.166
ns2.sina.com                                  4482      IN     A        114.134.80.145
ns4.sina.com                                  16316     IN     A        123.125.29.99
ns3.sina.com                                  177728    IN     A        61.172.201.254
ns1.sina.com                                  7274      IN     A        114.134.80.144

源码包使用dpkg不行

root@kali:~# dnsmap sina.com -w dns.txt
dnsmap 0.30 - DNS Network Mapper by pagvac (gnucitizen.org)
有点慢。。。。。。
[email protected]:~# dpkg -L dnsrecon
/.
/usr
/usr/share
/usr/share/man
/usr/share/man/man1
/usr/share/man/man1/dnsrecon.1.gz
/usr/share/doc
/usr/share/doc/dnsrecon
/usr/share/doc/dnsrecon/README.md.gz
/usr/share/doc/dnsrecon/copyright
/usr/share/doc/dnsrecon/changelog.Debian.gz
/usr/share/dnsrecon
/usr/share/dnsrecon/tools
/usr/share/dnsrecon/tools/parser.py
/usr/share/dnsrecon/lib
/usr/share/dnsrecon/lib/mdnsenum.py
/usr/share/dnsrecon/lib/__init__.py
/usr/share/dnsrecon/lib/dnshelper.py
/usr/share/dnsrecon/lib/msf_print.py
/usr/share/dnsrecon/lib/gooenum.py
/usr/share/dnsrecon/lib/whois.py
/usr/share/dnsrecon/namelist.txt
/usr/share/dnsrecon/msf_plugin
/usr/share/dnsrecon/msf_plugin/dnsr_import.rb
/usr/share/dnsrecon/dnsrecon.py
/usr/bin
/usr/bin/dnsrecon
[email protected]:~# dnsrecon -d sina.com --lifetime(超时时间)  10 -t(强度) brt -D /usr/share/dnsrecon/namelist.txt
[*] Performing host and subdomain brute force against sina.com
[!] Wildcard resolution is enabled on this domain
[!] It is resolving to 202.102.110.204
[!] All queries will resolve to this address!!
[*] Do you wish to continue? y/n
y
[*]      A 1.sina.com 202.102.110.204
[*]      A 0.sina.com 202.102.110.204
[*]      A 02.sina.com 202.102.110.204
[*]      A 03.sina.com 202.102.110.204
[*]      A 01.sina.com 202.102.110.204
[*]      A 3.sina.com 202.102.110.204
[*]      A 18.sina.com 202.102.110.204
[*]      A 20.sina.com 202.102.110.204
[*]      A abc.sina.com 202.102.110.204
[*]      A adam.sina.com 202.102.110.204
[*]      A administrador.sina.com 202.102.110.204
[*]      A administrators.sina.com 202.102.110.204
[*]      A admins.sina.com 202.102.110.204
[*]      CNAME ads.sina.com region.sina.usgcac.cdnetworks.net
[*]      CNAME region.sina.usgcac.cdnetworks.net n2.panthercdn.com
[*]      A n2.panthercdn.com 14.0.35.230
[*]      A n2.panthercdn.com 14.0.38.86
[*]      A ae.sina.com 202.102.110.204
[*]      A affiliate.sina.com 202.102.110.204
[*]      A admin.sina.com 202.102.110.204
[*]      A administracion.sina.com 202.102.110.204
……
^C[-] You have pressed Ctrl-C. Saving found records.
[*] Waiting for 9 remaining threads to finish.
[*]      A distributer.sina.com 202.102.110.204
[*]      A dm.sina.com 202.102.110.204
[*]      A devserver.sina.com 202.102.110.204
[*]      A dns.sina.com 202.102.110.204
[*]      A discuss.sina.com 202.102.110.204
[*] 254 Records Found
[email protected]:~# dnsrecon -t std -d sina.com 忘了加字典了,这中方式比brt慢
[*] Performing General Enumeration of Domain:
Traceback (most recent call last):
  File "./dnsrecon.py", line 1681, in <module>
    main()
  File "./dnsrecon.py", line 1524, in main
    spf_enum, do_whois, zonewalk)
  File "./dnsrecon.py", line 956, in general_enum
    dns_sec_check(domain, res)
  File "./dnsrecon.py", line 859, in dns_sec_check
    answer = res._res.query(domain, ‘DNSKEY‘)
  File "/usr/lib/python2.7/dist-packages/dns/resolver.py", line 824, in query
    raise NoNameservers
dns.resolver.NoNameservers

whois 根据这些网站来查询;

[email protected]:~# whois sina.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Server Name: SINA.COM.CN
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com

   Domain Name: SINA.COM
   Registrar: NETWORK SOLUTIONS, LLC.
   Sponsoring Registrar IANA ID: 2
   Whois Server: whois.networksolutions.com
   Referral URL: http://networksolutions.com
   Name Server: NS1.SINA.COM
   Name Server: NS1.SINA.COM.CN
   Name Server: NS2.SINA.COM
   Name Server: NS2.SINA.COM.CN
   Name Server: NS3.SINA.COM
   Name Server: NS3.SINA.COM.CN
   Name Server: NS4.SINA.COM
   Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
   Updated Date: 26-nov-2014
   Creation Date: 16-sep-1998
   Expiration Date: 15-sep-2019

>>> Last update of whois database: Fri, 18 Sep 2015 16:00:27 GMT <<<

NOTICE: The expiration date displayed in this record is the date the
registrar‘s sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant‘s agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar‘s Whois database to
view the registrar‘s reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services‘ ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time. 

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.

For more information on Whois status codes, please visit
https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en.

Domain Name: SINA.COM
Registry Domain ID: 2243615_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.networksolutions.com
Registrar URL: http://networksolutions.com
Updated Date: 2015-01-28T23:23:26Z
Creation Date: 1998-09-16T04:00:00Z
Registrar Registration Expiration Date: 2019-09-15T04:00:00Z
Registrar: NETWORK SOLUTIONS, LLC.
Registrar IANA ID: 2
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.8003337680
Reseller:
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: SINA.COM TECHNOLOGY(CHINA)CO.,LTD
Registrant Organization: SINA.COM TECHNOLOGY(CHINA)CO.,LTD
Registrant Street: BEIJING IDEAL PLAZA,20F NO.58
Registrant City: beijing
Registrant State/Province: CN
Registrant Postal Code: 100080
Registrant Country: CN
Registrant Phone: +86.1058983009
Registrant Phone Ext:
Registrant Fax: +86.1082607527
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:
Admin Name: Xie, Guomin
Admin Organization: SINA.COM TECHNOLOGY(CHINA)CO.,LTD
Admin Street: BEIJING IDEAL PLAZA,20F NO.58
Admin City: beijing
Admin State/Province: CN
Admin Postal Code: 100080
Admin Country: CN
Admin Phone: +86.1058983078
Admin Phone Ext:
Admin Fax: +86.1082607527
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID:
Tech Name: Xie, Guomin
Tech Organization: SINA.COM TECHNOLOGY(CHINA)CO.,LTD
Tech Street: BEIJING IDEAL PLAZA,20F NO.58
Tech City: beijing
Tech State/Province: CN
Tech Postal Code: 100080
Tech Country: CN
Tech Phone: +86.1058983078
Tech Phone Ext:
Tech Fax: +86.1082607527
Tech Fax Ext:
Tech Email: [email protected]
Name Server: NS1.SINA.COM
Name Server: NS2.SINA.COM
Name Server: NS1.SINA.COM.CN
Name Server: NS2.SINA.COM.CN
Name Server: NS3.SINA.COM.CN
Name Server: NS3.SINA.COM
Name Server: NS4.SINA.COM
DNSSEC: Unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of whois database: Fri, 18 Sep 2015 16:00:27 GMT <<<

The data in Networksolutions.com‘s WHOIS database is provided to you by
Networksolutions.com for information purposes only, that is, to assist you in
obtaining information about or related to a domain name registration
record. Networksolutions.com makes this information available "as is," and
does not guarantee its accuracy. By submitting a WHOIS query, you
agree that you will use this data only for lawful purposes and that,
under no circumstances will you use this data to: (1) allow, enable,
or otherwise support the transmission of mass unsolicited, commercial
advertising or solicitations via direct mail, electronic mail, or by
telephone; or (2) enable high volume, automated, electronic processes
that apply to Networksolutions.com  (or its systems). The compilation,
repackaging, dissemination or other use of this data is expressly
prohibited without the prior written consent of Networksolutions.com.
Networksolutions.com reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by these terms.
root@kali:~# whois wooyun.org
Domain Name:WOOYUN.ORG
Domain ID: D159099935-LROR
Creation Date: 2010-05-06T08:50:48Z
Updated Date: 2015-01-07T03:37:41Z
Registry Expiry Date: 2024-05-06T08:50:48Z
Sponsoring Registrar:Hichina Zhicheng Technology Limited (R1373-LROR)
Sponsoring Registrar IANA ID: 420
WHOIS Server:
Referral URL:
Domain Status: clientDeleteProhibited -- http://www.icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited -- http://www.icann.org/epp#clientTransferProhibited
Registrant ID:hc556860480-cn
Registrant Name:Fang Xiao Dun
Registrant Organization:Fang Xiao Dun
Registrant Street: Haidian District JuYuan Road 6# 502
Registrant City:Beijing
Registrant State/Province:Beijing
Registrant Postal Code:100080
Registrant Country:CN
Registrant Phone:+86.18610137578
Registrant Phone Ext:
Registrant Fax: +86.18610137578
Registrant Fax Ext:
Registrant Email:xssshell@gmail.com
Admin ID:HC-009652962-CN
Admin Name:Fang Xiaodun
Admin Organization:Beijing Bigfish Technology
Admin Street: Haidian District JuYuan Road 6# 502
Admin City:Beijing
Admin State/Province:Beijing
Admin Postal Code:100080
Admin Country:CN
Admin Phone:+86.18610137578
Admin Phone Ext:
Admin Fax: +86.18610137578
Admin Fax Ext:
Admin Email:xssshell@gmail.com
Tech ID:HC-844637505-CN
Tech Name:Fang Xiaodun
Tech Organization:Beijing Bigfish Technology
Tech Street: Haidian District JuYuan Road 6# 502
Tech City:Beijing
Tech State/Province:Beijing
Tech Postal Code:100080
Tech Country:CN
Tech Phone:+86.18610137578
Tech Phone Ext:
Tech Fax: +86.18610137578
Tech Fax Ext:
Tech Email:xssshell@gmail.com
Name Server:NS1.DNSV2.COM
Name Server:NS2.DNSV2.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC:Unsigned

Access to Public Interest Registry WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registry registry database. The data in this record is provided by Public Interest Registry for informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to(a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient‘s own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator, a Registrar, or Afilias except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. For more information on Whois status codes, please visit https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en.
root@kali:~# whois 202.106.0.20
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to ‘202.106.0.0 - 202.106.255.255‘

inetnum:        202.106.0.0 - 202.106.255.255
netname:        UNICOM-BJ
descr:          China Unicom Beijing province network
descr:          China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         SY21-AP
mnt-by:         APNIC-HM
mnt-lower:      MAINT-CNCGROUP-BJ
mnt-routes:     MAINT-CNCGROUP-RR
mnt-irt:        IRT-CU-CN
changed:        hm-changed@apnic.net 20031017
status:         ALLOCATED PORTABLE
changed:        hm-changed@apnic.net 20060124
changed:        hm-changed@apnic.net 20090507
changed:        hm-changed@apnic.net 20090508
source:         APNIC

irt:            IRT-CU-CN
address:        No.21,Jin-Rong Street
address:        Beijing,100140
address:        P.R.China
e-mail:         zhouxm@chinaunicom.cn
abuse-mailbox:  zhouxm@chinaunicom.cn
admin-c:        CH1302-AP
tech-c:         CH1302-AP
auth:           # Filtered
mnt-by:         MAINT-CNCGROUP
changed:        zhouxm@chinaunicom.cn 20101110
changed:        hm-changed@apnic.net 20101116
source:         APNIC

person:         ChinaUnicom Hostmaster
nic-hdl:        CH1302-AP
e-mail:         abuse@cnc-noc.net
address:        No.21,Jin-Rong Street
address:        Beijing,100033
address:        P.R.China
phone:          +86-10-66259764
fax-no:         +86-10-66259764
country:        CN
changed:        abuse@cnc-noc.net 20090408
mnt-by:         MAINT-CNCGROUP
source:         APNIC

person:         sun ying
address:        fu xing men nei da jie 97, Xicheng District
address:        Beijing 100800
country:        CN
phone:          +86-10-66030657
fax-no:         +86-10-66078815
e-mail:         hostmast@publicf.bta.net.cn
nic-hdl:        SY21-AP
mnt-by:         MAINT-CNCGROUP-BJ
changed:        suny@publicf.bta.net.cn 19980824
changed:        hm-changed@apnic.net 20060717
changed:        hostmast@publicf.bta.net.cn  20090630
source:         APNIC

% This query was served by the APNIC Whois Service version 1.69.1-APNICv1r6 (WHOIS1)
时间: 2024-08-01 21:09:22

DNS区域传输、DNS字典爆破、DNS注册信息的相关文章

【安全牛学习笔记】DNS区域传输、DNS字典爆破、DNS注册信息

DNS区域传输.DNS字典爆破.DNS注册信息 ╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋ ┃DNS区域传输                                                    ┃ ┃  dig @ns1.example.com example.com axfr    ┃ ┃  host -T -l sina.com 8.8.8.8                             ┃ ╋━━━━━━━━━━━━━━━━━

AXFR和IXFR区域传输及原理

由于区域在DNS中发挥着重要的作用,因此希望在网络上的多个DNS服务器中提供区域,以提供解析名称查询时的可用性和容错.否则,如果使用单个服务器而该服务器没有响应,则该区域中的名称查询会失败.对于主要区域的其他服务器,必须进行区域传输,以便从主要区域中复制和同步所有区域副本. 1. AXFR和IXFR区域传输 当新的DNS服务器添加到网络,并且配置为现有区域的新的辅助服务器时,它执行该区域的完全初始传送,以便获得和复制区域的一份完整的资源记录副本.对于大多数较早版本的DNS服务器实现,在区域更改后

DNS区域传送漏洞实验以及二级域名爆破

目录: 1.DNS服务器的域传送漏洞(nslookup交互式.非交互式.批处理三种方式) 2.写个二级域名爆破脚本 一.DNS服务器的域传送漏洞 实验环境: 服务端:Windows2008 安装DNS服务(创建A记录),安装IIS服务(搭建一个站点) 客户端:win10(DNS设置为windows 2008的IP地址) 实验步骤: 一.服务端搭建一个网站 1.服务端搭建一个网站并设置默认主页 2.服务端设置DNS,并创建一个主机记录 3.客户端测试网站以及DNS创建的主机记录(通过主机名访问)

ADMT3.2域迁移之Server2003至Server2012系列(二)创建DNS区域

上一篇博文我们已经将两台域控准备完毕了,那么本章我们就来操作最重要的步骤创建DNS区域. 我们简单来看一下拓扑: 登录到win2008 并打开DNS管理器 右击shuo.com区域-属性 以下操作在目标服务器 输源服务器FQDN名称及IP地址.如提示解析不到也没关系,等我们创建完成辅助区域后就可以了. 设置传送区域 新建区域 选择[辅助区域] 输入源服务器域名 输入源服务器IP 解析成功 完成设置 查看同步记录 以下操作在源服务器 在源服务器的DNS设置与目标服务器一样 添加目标服务器名称 选取

windows2008 dns备传输配置

hi,大家好很久没更新了,年底各种忙,最近做一个域的文件共享的迁移,遇到一写问题,记录一下. DNS安装我就不说了.(206主205从) 在主DNS(206)上需要配置: 点击编辑: 主的配置很简单,下面进行从DNS(205)的配置,名字要与主DNS的一样. 发现添加的时候报错,错误如下: DNS 服务器检测到它未被列入目录分区 ForestDnsZones.xx.com.cn 的复制范围.这阻止了应复制到 xx.com.cn 林中所有 DNS 服务器的区域复制到该 DNS 服务器. 若要创建或

&lt;转&gt;DNS服务系列之二:DNS区域传送漏洞的安全案例

DNS区域传送(DNS zone transfer)指的是一台备用服务器使用来自主服务器的数据刷新自己的域(zone)数据库.这为运行中的DNS服务提供了一定的冗余度,其目的是为了防止主的域名服务器因意外故障变得不可用时影响到整个域名的解析.一般来说,DNS区域传送操作只在网络里真的有备用域名DNS服务器时才有必要用到,但许多DNS服务器却被错误地配置成只要有client发出请求,就会向对方提供一个zone数据库的详细信息,所以说允许不受信任的因特网用户执行DNS区域传送(zone transf

DNS区域传送漏洞的安全案例

DNS区域传送(DNS zone transfer)指的是一台备用服务器使用来自主服务器的数据刷新自己的域(zone)数据库.这为运行中的DNS服务提供了一定的冗余度,其目的是为了防止主的域名服务器因意外故障变得不可用时影响到整个域名的解析.一般来说,DNS区域传送操作只在网络里真的有备用域名DNS服务器时才有必要用到,但许多DNS服务器却被错误地配置成只要有client发出请求,就会向对方提供一个zone数据库的详细信息,所以说允许不受信任的因特网用户执行DNS区域传送(zone transf

TCP/TP:DNS区域(Zone)

之前阅读资料不是特别明白,看到一个博主的解释,豁然开朗,特此记录. https://blog.csdn.net/huangzx3/article/details/79347556 DNS区域(ZONE):DNS域名空间中连续的树,将域名空间按照需要划分为若干较小的管理单位.栗子:在baidu中设置一个DNS服务器,这个DNS服务器将完成域名空间"baidu.com"下的域名解析工作,我们称之为一个区域(ZONE).在fzu中设置一个DNS服务器,这个服务器完成域名空间"fzu

DNS服务的协议讲解以及DNS服务搭建

1.什么是DNS服务? DNS服务是实现把主机名或域名解析为一个IP的服务,或者这样理解,当你搜索一个网址时,你需要键入刚网站对应的ip地址(因为计算机更理解数字啊),但是大量的ip地址作为网址搜索时,无疑是一件很麻烦的事情,好比通讯录一样,因此我们就需要通过一个容易记忆的字符串记录,而DNS服务就是完成字符串与ip地址之间的转换. 2.了解一些基础概念: FQDN:全限定域名,即逻辑上的主机名加上主机在域中的位置, TLD:顶级域名,有两个词组成,中间有小数点,全球一共13个根节点 分类: 国