subsidiary name servers). Overview Materials Needed Considerations Walkthrough Determine the authoritative name server(s) for the organization’s primary domain: $ host -t ns sample.org sample.org name server ns1.something.net. sample.org name server ns2.something.net. Attempt a zone transfer on that domain, using that name server: $ host -l sample.org ns1.something.net Using domain server: Name: ns1.something.net Address: 256.0.0.1#53 Aliases: www.sample.org has address 256.0.0.2 mail.sample.org has address 256.0.0.3 webmail.sample.org has address 256.0.0.4 ftp.sample.org has address 256.0.0.5 foo.sample.org has address 256.0.0.6 bar.sample.org has address 256.0.0.7 Recommendation Eliminate or limit zone transfer permissions The DNS provider for sample.org allows anonymous DNS zone transfers, revealing subdomain information An anonymous zone transfer request revealed the following subdomains: www.sample.org has address 256.0.0.2 Page 42 of 240