Re: [Full-Disclosure] Question for DNS pros

[Nils Ketelsen <nils@xxxxxxxxxxxxxxxxxxxxxxxxx>]

On Fri, Jul 23, 2004 at 12:32:28PM -0500, Paul Schmehl wrote:
> Can this be done?
> 
> Conditions:
> 1) You know an IP address that is running a DNS server.  (IOW, it responds 
> to digs.)
> 2) You do not know the hostname or domain of the host.
> 3) The DNS server does not allow zone transfers.
> 
> You want to find out *all* the domains that that DNS server is 
> authoritative for.  (Essentially you're trying to find out what's in the 
> named.conf file rather than zone file info.)

Florian Weimer has an interesting project for exactly that. By analyzing all
request and replies to a resolver and writing the results into a database he
gets a system to allow this kind of inverse-queries (I avoid using the term
reverse queries because of the confusion this might cause with reverse
lookups).

Basically this allows you to say "for what hosts did I get replies from the
nameser xyz?". This does not give you all zones of the nameserver, but only
those which at least were requested once by the resolver you are looking at.
Given enough resolvers gathering this data this might allow a fairly big
overview though. 

I do not know wether is tool is available to the public yet, though. Maybe
he can say something about it (Florian is also reading here). I have not yet
figured out, what I might use this tool for, but I think it will allow for
interesting things regarding filtering solutions. And it is a nice hack.


Nils
-- 
Gibt's eigentlich auch schon emacs-Einbauküchen?

[nico.hoffmann@xxxxxxxxxxxxxxxxxxxxx (Nico Hoffmann)
zum Thema "vi-Tassen" in de.alt.arnooo]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html