> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_14-zone-transfer.md).

# recon\_14 (zone transfer)

View the exercise here: [PentesterLab: Recon 14](https://pentesterlab.com/exercises/recon_14/course)

### **OBJECTIVE**

For this challenge, your goal is to perform a zone transfer on **z.hackycorp.com**.

### **ZONE TRANSFER**

Zone transfers are usually used to synchronize multiple DNS servers. Only a list of pre-defined hosts should be able to perform this operation. However, it's sometimes possible to retrieve this information and can give you access to new hosts.

### **SOLUTION**

To zone transfer, we use: **`dig axfr @<DNS_SERVER> z.hackycorp.com`**

We first check for the DNS server:

{% hint style="info" %}

```bash
dig ns z.hackycorp.com
```

* **`dig`**: The tool used for querying DNS.
* **`ns`**: The query type that asks for the names of the name servers (NS records) for the specified domain.
* **`z.hackycorp.com`**: The domain you're querying.
  {% endhint %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FfgomYINL0XXE7gCSlpSC%2FScreenshot_2024-08-22_at_11.20.54.png?alt=media&amp;token=fc416137-a408-47e1-9acc-980e4acca681" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}
After getting the name server, we can now zone transfer using this:

```bash
dig axfr @z.hackycorp.com z.hackycorp.com
```

* **`AXFR`**: The query type for a **zone transfer**, which requests a full copy of all DNS records for a domain.
* **`@z.hackycorp.com`**: Specifies the DNS server (`z.hackycorp.com`) to perform the zone transfer from.
* **`z.hackycorp.com`**: The domain you're requesting the zone transfer for.
  {% endhint %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2Fc1TJunOsbaQAh5zWc6zM%2Fimage.png?alt=media&amp;token=0d3f0267-183e-4f15-9390-8de48e382b14" alt="" width="563"><figcaption></figcaption></figure>