id: dns-axfr-enabled

info:
  name: DNS Zone Transfer Check (AXFR)
  author: matejsmycka
  severity: medium
  description: |
    Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
  reference:
    - https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
  metadata:
    verified: true
    shodan-query: port:53
  tags: dns,tcp,axfr,code

code:
  - engine:
      - bash
    source: |
      domain=$Host
      dig axfr $domain @$(dig $domain ns +short | head -n1)

    matchers:
      - type: regex
        regex:
          - 'XFR size: [1-9][0-9]* records?'
        condition: and

    extractors:
      - type: regex
        regex:
          - 'SOA\s+([^\s]+)'
        group: 1
# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950