0

I'm hoping someone can help. I'm struggling to work this out and hope that there is a simple way around it.

I'm trying to get a list of all machines in a local DNS server. For the purposes of my testing it's a Win2008 DNS, but I'd like to try and find a way that works for any if possible.

Essentially I want the equivalent of nslookup, but for every machine in the DNS. For example. I don't even mind if it just lists Machine names.

192.168.0.1   Desktop1.domain.local
192.168.0.2   Server2.ad.domain.local
192.168.0.3   Server3.sub.domain.local

I don't mind if the solution is Windows or Linux.

I've been trying to use Dig in Ubuntu, but I'm starting to think it's not really designed to do what I thought it was.

dig +nocmd +domina.local any +multiline +noall +answer

Sort of in my basic logic, I want something like

nslookup -all

or

nslookup *
1
  • IF the server allows you to do domain transfers, you may be able to use dig axfr domainname Jul 16, 2015 at 19:03

1 Answer 1

0

So you want to enumerate the contents of DNS zones. That's not easily possible from the "outside" except for brute-force checks going down the path you've started -- it's kind of like cracking passwords. You'd have to query for all possible names, check for wildcards with pattern matches, etc... it's non-trivial and very resource intensive, and also very noticeable to vigilant admins (it'll look like a DoS attack if you're not careful). But I don't even think black hats would approach it this way, it'd be easier to either install a sniffer in front of the DNS server and passively collect the useful names over time or just compromise the DNS server itself.

So I'm not sure your purpose or use case, but there are much easier / legit ways. E.g., get access to the Microsoft DNS server to open up an MMC, connect to the DNS service and then you'll see all the zones and within each all the names. Or you could ask the admin for an export of all the zones from the MMC console. Or request to be able to pull zone transfers to your "test" server periodically (e.g., using "dig axfr @" or just setting up a secondary). These are much easier and non-intrusive ways to get what you want, and assuming this is for a legitimate purpose, shouldn't be a big deal.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .