> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_15-int-zone-transfer.md).

# recon\_15 (int zone transfer)

View the exercise here: [PentesterLab: Recon 15](https://pentesterlab.com/exercises/recon_15/course)

### **OBJECTIVE**

For this challenge, your goal is to perform a zone transfer on the internal zone named: "**int**" using the nameserver of **z.hackycorp.com**.

### **ZONE TRANSFER**

Zone transfers are usually used to synchronize multiple DNS servers. Only a list of pre-defined hosts should be able to perform this operation. However, it's sometimes possible to retrieve information from internal zones by asking publicly available servers.

### **SOLUTION**

{% hint style="success" %}

```bash
dig AXFR @z.hackycorp.com int
```

* **`dig`**: The tool for querying DNS.
* **`AXFR`**: The query type, which requests a **zone transfer** (a copy of all DNS records for a domain).
* **`@z.hackycorp.com`**: Specifies the DNS server (`z.hackycorp.com`) to contact.
* **`int`**: The domain (zone) you're requesting the transfer for, in this case, `int`.
  {% endhint %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FC3YzRDpFRNLXDlQiGtlb%2Fimage.png?alt=media&amp;token=810766ac-4235-49f1-932e-e35b2f5bd6aa" alt="" width="563"><figcaption></figcaption></figure>