Information Gathering Web Addition; Active Subdomain Enumeration

Hello,

I was able to complete all the questions for this page except the second one:
Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer.

Can someone help me understand this? I was under the impression that I was looking for the amount of different domains with subdomains under them, e.g admin.inlanefreight.htb, us.inlanefreight.htb, etc

I think I’m failing to understand the terminology…

Hi, think of a zone as a “file” that contains is own subdomains and is hosted in a DNS server responsible for storing and serving them (although you can use the same DNS server for multiple zones). That file/zone has a parent zone, is a hierarchical structure, up to the root servers (.)

E.g. hackthebox is a zone, and all that .com knows is how to point you to the NS records of hackthebox. www.hackthebox.com won’t usually be a zone, just a A record inside the “hackthebox” file/zone.

A “subdomain” can be just a A/TXT/etc record or it can be a zone.

Try AXFRing all the subdomains you find (use a script, or manually), and if you want a hint there are very very few zones.

3 Likes

I understand now. Conceptually I was close, but I was thinking too broadly. You’re explanation helped me realize the answer.

1 Like