Find the list of subdomains of a Web domain

[EricTheRed]

There is a widespread practice by webmasters and administrators of websites and servers to create specific sub-domains to access hidden areas, administration or database. There is a way to retrieve the list of subdomains of a normal domain, and although it is easily lockable by the site owner, as a rule is enabled. I'm talking about the record AXFR , whose original purpose is to allow the transfer of control from one domain to another or the creation of servers DNS support to the primary. There are many web pages that use the programs that I will describe below, for example Magic-Net , but I want to explain in which they rely to get the information you show us.

[EricTheRed]

All information posted here is public and accessible by anyone, not about any breach of security, it is simply a configuration that gives us some information on a domain, this can get us out of trouble trying to repair a domain that is in a outside DNS server.

There are three major utilities to obtain domain information in Linux:

• whois - It returns information from the registration of a domain.
• host - Resolves the IP address of a domain and vice versa.
• dig - Interrogate DNS server to give you information about a domain.

The whois command returns us much information on registration, which for our purpose we need to know your DNS servers and ns0.meneame.net ns1.meneame.net. Using the host command can ascertain that hosts the page. It is no secret, the administrator Ricardo Galli explained in his blog on your network infrastructure for some time, but if I had not done well could know. Finally we can tinker with the dig command to obtain domain information. Using simple queries only get basic information about the domain, if the use of the AXFR record is enabled will return a list of all sub-domains, but show an error indicating that the transfer of domains is disabled.

[EricTheRed]

Normally access to restricted records indicating which AXFR DNS servers can access (IP filter, come on), but usually they make a mistake: Domain servers are allowed access to records AXFR. As a note to say that more should be a disastrous error dns server to use as a domain, a subdomain of the domain itself: meneame.net -> ns1.meneame.net. If the domain expires, is canceled or administrative whatever happens is going to ruin everything, including the DNS resolution. Incidentally, this issue of AXFR settings is widespread. Surprisingly the PP is rather restricted but your domain records violates the convention with.'s, Whose minimum length is 3 characters and they only use 2, plugs politics ... The UI register a legal, not like before, and seems to restrict access to records AXFR. Same with BNG, UPyD and PNV. I can not think more domains to try, you can keep yourself.