nerdexam
GIAC

GPEN · Question #488

What difference would you expect to result from running the following commands; (I). S dig _s domain.com target.com -t AXFR and (2). S dig _s.domain.com target.com -t IXFR=1002200301

The correct answer is B. Command (1) will display all information about a domain and command (2) willprovide only. DNS zone transfers differ by scope - AXFR transfers the complete zone while IXFR with a serial number transfers only records that changed after that serial, and this distinction is visible in the dig command flags.

Penetration Testing Foundations & Reconnaissance

Question

What difference would you expect to result from running the following commands; (I). S dig ﹏s domain.com target.com -t AXFR and (2). S dig ﹏s.domain.com target.com -t IXFR=1002200301

Options

  • ACommand (I) will display incremental information about a domain and command (2) Will
  • BCommand (1) will display all information about a domain and command (2) willprovide only
  • CCommand (I) will display all information about a domain and command (2) willprovide only
  • DCommand (I) will display all information about a domain and command (2) willprovide only

How the community answered

(21 responses)
  • A
    19% (4)
  • B
    71% (15)
  • C
    5% (1)
  • D
    5% (1)

Why each option

DNS zone transfers differ by scope - AXFR transfers the complete zone while IXFR with a serial number transfers only records that changed after that serial, and this distinction is visible in the dig command flags.

ACommand (I) will display incremental information about a domain and command (2) Will

This inverts the behavior - AXFR is the full zone transfer and IXFR is the incremental one, not the reverse.

BCommand (1) will display all information about a domain and command (2) willprovide onlyCorrect

AXFR (Authoritative Zone Transfer) retrieves the entire zone file from the DNS server, returning all resource records. IXFR (Incremental Zone Transfer) paired with a serial number such as IXFR=1002200301 instructs the server to return only records that were added or modified after that zone serial, producing a smaller, incremental response.

CCommand (I) will display all information about a domain and command (2) willprovide only

AXFR is unambiguously the full zone transfer protocol and cannot be characterized as returning partial or filtered information.

DCommand (I) will display all information about a domain and command (2) willprovide only

The serial number parameter in IXFR restricts the transfer to changes after that point, making it definitionally a partial subset of what AXFR would return.

Concept tested: DNS AXFR vs IXFR zone transfer types with dig

Source: https://datatracker.ietf.org/doc/html/rfc5936

Topics

#DNS zone transfer#AXFR#IXFR#dig command

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice