full-disclosure - Re: DNS mining ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b400c69a0704101337g730e5ebci6669a40c4789abc5@mail.gmail.com>
Date: Tue, 10 Apr 2007 22:37:12 +0200
From: "Maxim Veksler" <hq4ever@...il.com>
To: "Valdis.Kletnieks@...edu" <Valdis.Kletnieks@...edu>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: DNS mining ?

On 4/9/07, Valdis.Kletnieks@...edu <Valdis.Kletnieks@...edu> wrote:
> On Mon, 09 Apr 2007 16:31:02 +0300, Maxim Veksler said:
> > I have a domain name which has it's primary A record pointing at google.
> > This domain hasn't been published anywhere
>
> Note that there *do* exists feeds of things like "all domains registered in
> the last 24 hours",

That's a reasonable possibility. Are you suggesting some service scans
those lists and then produces statistical data from them? Could you
point me to such list, I'd be interested to know how it works.

> and other ways to get lists of things like "everything
> in *.com".  So "never published" does *not* equate directly to "not findable".
>

OK, that is not practical. Scanning the whole DNS range for *.com of
what ever will taken a considerably long time.

> Did you check your nameserver logs for:
>
> a) Do you prohibit AXFR requests except from your secondaries?
> b) Do your secondaries prohibit AXFRs entirely?
> c) Has anybody *tried* to do an AXFR? If so, who?
>

I use the NS of my domain registar (gandi.net), even if their DNS
server was jeopardised - The web sites appearing on that list do no
all come from gandi.net.

-- 
Cheers,
Maxim Veksler

"Free as in Freedom" - Do u GNU ?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/