You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain. If the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?

Question

Accepted Answer

B. Is -d accorp.local In nslookup's interactive mode, 'ls -d domainname' requests a full zone transfer from the authoritative DNS server, retrieving all resource records for the domain. After pointing nslookup at the target server (192.168.10.2), issuing 'ls -d abccorp.local' attempts the zone transfer and returns all DNS records if the server permits it.

Answer

A. list domain=abccorp.local type=zone 'list domain=' is not valid nslookup interactive syntax; nslookup does not recognize this command format.

Answer

C. list server=192.168.10.2 type=all 'list server=' is also invalid nslookup syntax; there is no such command structure in the nslookup interactive shell.

Answer

D. Iserver 192.168.10.2 -t all 'Iserver' is not a valid nslookup command; 'lserver' changes the default DNS server but does not initiate a zone transfer or retrieve records.

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain. If the…

Question

Options

How the community answered

Why each option

Topics

Community Discussion