You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain. If the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?

Question

Accepted Answer

B. Is -d accorp.local The 'ls -d <domain>' command entered at the nslookup prompt requests a full zone transfer, instructing the DNS server to list every record in the zone; the '-d' flag includes all record types rather than just A records. This is the correct nslookup syntax for enumerating internal DNS records during a penetration test, and the server is set beforehand using the 'server 192.168.10.2' command.

Answer

A. list domain=abccorp.local type=zone 'list domain=abccorp.local type=zone' is not valid nslookup syntax - the nslookup ls subcommand does not accept key=value style parameters.

Answer

C. list server=192.168.10.2 type=all 'list server=192.168.10.2 type=all' is not a valid nslookup command - server switching uses the standalone 'server' command and zone listing uses 'ls', not 'list'.

Answer

D. Iserver 192.168.10.2 -t all 'lserver' switches the default DNS server but is unrelated to zone transfers, and '-t all' is not a valid flag for listing zone records in nslookup.

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain. If the DNS

Question

Options

How the community answered

Why each option

Topics

Community Discussion