DNS-ZONE-TRANSFERDiscovery

Unrestricted Zone Transfer (AXFR)

dig @ns axfr <domain> succeeds — full DNS zone leaks every hostname, including unlinked dev/admin/staging.

§ Where this technique fits

DNS-ZONE-TRANSFER is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

AXFR → discover shadow-IT staging → exploitable web app
DNS server allows unrestricted AXFR. Pull the full zone, find admin- / staging- / dev- hostnames never linked, hit one with default creds / leftover debug routes.
step 2 / 6

§ What commonly comes next

01
Subdomain Enumeration
W-RECON-SUBDOMAIN · Reconnaissance
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

AXFR → discover shadow-IT staging → exploitable web app

§ What commonly comes next