Lion Cipher Lab
Enumerate an entire domain through an open DNS zone transfer (AXFR) — then lock it down
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Reconnaissance is the quiet first move of every real attack, and DNS is the richest, cheapest source of it there is. Before an attacker sends a single packet at your applications, they want a map: what hosts exist, what they are called, what they do. Names are enormously informative — a host called `jenkins` runs a build server, `backup` holds copies of everything, `vpn-old` is a decommissioned gateway nobody patched, `db-prod` is the production database. Normally an attacker has to piece that map together slowly and noisily, guessing names one at a time. An open DNS zone transfer hands them…
What you'll learn
- defining DNS from zero — authoritative server, zone, resource records (A, CNAME, MX, TXT, SRV, NS), primary vs secondary — and explaining what a zone transfer (AXFR) is and why it legitimately exists
- standing up a BIND 9 authoritative server in Docker for a fake internal zone with a rich zonefile, on a private Docker network, so the whole exercise touches nothing but your own machine
- reproducing the classic open-transfer misconfiguration with `allow-transfer { any; }` and understanding that modern BIND does NOT default to this
- pulling an entire zone from a second container with one `dig AXFR corp.internal @dns-server`, and reading the dump as what it is — a complete map of the internal attack surface
- explaining WHY hostname disclosure is serious: names like jenkins, backup, vpn-old and db-prod tell an attacker exactly what to target, with no scanning and no noise
- applying the fix three ways — allow-transfer none, restricting to specific secondary IPs, and authenticating transfers with a TSIG key per RFC 8945 — and knowing why TSIG is the real answer
- measuring before and after with the same probe: `dig AXFR` dumps the whole zone before the fix and returns a failed transfer after it, while a normal `dig A host` still resolves
- judgment: recognising an open transfer on an assessment with the least-invasive proof, reporting cause/impact/fix, and preventing recurrence with locked zone templates and split-horizon DNS
Steps in this lab
- What DNS is, and what a zone transfer (AXFR) actually is
- Build the isolated lab: an authoritative BIND 9 server on your machine only
- Pull the whole zone — the finding, in one query, from the attacker container
- Why a list of names is a serious finding — read the dump like an attacker
- The fix, part 1: restrict the transfer — none, or specific secondaries — then measure
- The fix, part 2: authenticate the transfer with a TSIG key (the real answer)
- Honest negatives — say these out loud so the finding stays accurate
- Do it better — how to recognise, report, and prevent an open transfer