Re: anonymous Zonetransfer (AXFR) exploatation

[krymson () gmail com]

Just to address this one aspect of the thread, there was a recent case in North Dakota, US which was presumed to have 
determined that a DNS zone transfer constituted hacking [1]. This wasn't the whole complaint or reason for the ruling, 
but that is the part that media and places like Slashdot picked up and highlighted. I know precedence is important in 
US law, but I'm not sure this would stand up upon further scrutiny.

Nonetheless, the real point is to limit zone transfers.

[1] http://www.theregister.co.uk/2008/01/17/anti_spam_activist_lawsuit/


<- snip ->
I never heard of laws that forbids you to get DNS content from a server. Maybe I am late with the news, but
as long as it is only an information disclosure it shouldnt be less legal than a port scan.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------