GIAC Certified Incident Handler (GCIH) — Question 114

In the DNS Zone transfer enumeration, an attacker attempts to retrieve a copy of the entire zone file for a domain from a DNS server. The information provided by the DNS zone can help an attacker gather user names, passwords, and other valuable information. To attempt a zone transfer, an attacker must be connected to a DNS server that is the authoritative server for that zone. Besides this, an attacker can launch a Denial of Service attack against the zone's DNS servers by flooding them with many requests. Which of the following tools can an attacker use to perform a DNS zone transfer?
Each correct answer represents a complete solution. (Choose all that apply.)

Answer options

• A. Host
• B. Dig
• C. DSniff
• D. NSLookup

Correct answer: A, B, D

Explanation

The correct answers are A, B, and D as these tools are designed to perform DNS queries, including zone transfers. 'Host' and 'Dig' are specifically built for DNS operations, while 'NSLookup' also supports zone transfer requests. 'DSniff', on the other hand, is primarily focused on network sniffing and does not directly facilitate DNS zone transfers.