312-50 Question 44
Single answer▪ DNS FootprintingDuring an authorized reconnaissance phase, you are asked to identify internal hostnames and mail infrastructure for examplecorp.com while minimizing direct interaction with web servers. You already know the domain name but no subdomains. Which action would be the most effective DNS footprinting step to gather this information if the organization's DNS server is misconfigured to allow it?
- A
Attempt a DNS zone transfer (AXFR) against the authoritative name server for examplecorp.com
- B
Send repeated ICMP echo requests to the public web server and infer hostnames from TTL changes
- C
Perform a full TCP connect scan of ports 1-65535 on the mail gateway
- D
Capture ARP broadcasts on the target's internal network to enumerate internal DNS records
Show answer and explanation
Correct answer: A
Explanation
The best answer is attempting a DNS zone transfer (AXFR) from the authoritative name server. In real-world assessments and CEH-style scenarios, DNS footprinting often begins with querying public DNS infrastructure for records such as NS, MX, SOA, and, when possible, attempting zone transfers. If a DNS server is misconfigured to permit AXFR to unauthorized clients, the tester may obtain a complete or near-complete map of the zone, including internal naming conventions, mail servers, and other key systems. This is far more efficient and less intrusive than broad port scanning or host-based probing. Best practices from DNS administration guidance emphasize restricting zone transfers to approved secondary servers only. Public references include BIND administration guidance and standard DNS documentation such as RFC 5936, which defines AXFR behavior.
- A. Correct.
Correct. A DNS zone transfer (AXFR) request to an authoritative name server can reveal the contents of the DNS zone when misconfigured to allow transfers to unauthorized hosts. This may expose hostnames, mail exchangers (MX), name servers (NS), and other records useful in footprinting. In a CEH context, this is a classic DNS enumeration technique because it can provide broad visibility with minimal interaction beyond querying DNS.
- B. Incorrect.
Incorrect. ICMP echo requests can help determine host availability and sometimes infer network distance or filtering behavior, but they do not enumerate DNS records or reveal internal hostnames in a reliable way. TTL values are not a practical method for discovering subdomains or mail infrastructure.
- C. Incorrect.
Incorrect. A full TCP connect scan targets service discovery, not DNS footprinting. It creates far more noise than necessary and does not directly provide DNS zone contents or a structured list of hostnames. While a mail gateway scan may reveal open mail-related ports, it is not the most effective first step for discovering DNS-based infrastructure.
- D. Incorrect.
Incorrect. ARP is a Layer 2 protocol and works only on the local broadcast domain. During external reconnaissance, you would not be able to capture ARP broadcasts from the target's internal network unless you already had local access there. It is not a valid Internet-based DNS footprinting technique.