DNS zone transfer (AXFR)

A DNS server holds a domain's records (its zone): the A, CNAME, MX, NS, etc. To keep secondary servers in sync with the primary there's the zone transfer (AXFR), which copies the full zone. If the primary doesn't restrict who can request it, anyone can download all the records, including internal subdomains that appear in no link and aren't found by brute force.

To abuse it you first need the domain name tied to the IP. A reverse lookup usually does:

nslookup <ip> <ip>            # PTR -> e.g. trick.htb
dig -x <ip> @<ip>             # equivalent with dig

With the domain, request the transfer from the server itself:

dig ns <domain> @<ip> +short        # find the name servers
dig axfr <domain> @<ip>             # transfer with dig
host -l <domain> <ip>               # equivalent with host
host -t axfr <domain> <ip>
dnsrecon -d <domain> -n <ip> -t axfr
fierce --domain <domain> --dns-servers <ip>

If it's misconfigured, the response lists the whole zone. It commonly leaks internal environments (preprod-, dev-, staging-, admin panels) that are the real entry vector: a poorly secured pre-production app, a forgotten panel, etc.

Why it matters. Subdomain brute force only finds names in the wordlist; an AXFR hands them all at once and quietly, including ones you'd never guess. It's one of the first things to try when port 53 is open.

How to detect it. The signature is an AXFR-type query to 53/TCP from an IP that is not a configured secondary: BIND logs it as transfer of '<zone>' ... denied/approved, and almost no legitimate client (only secondaries) issues an AXFR. With query logging or an IDS, an external AXFR request is itself the indicator; it's usually preceded by a reverse PTR lookup to learn the domain.

Defence. Restrict transfers to the legitimate secondary servers (allow-transfer { ... } in BIND), use TSIG (shared keys) to authenticate them, and don't publish internal records in externally reachable zones. After finding an interesting subdomain, the next step is usually virtual-host fuzzing to find even more.