Using DNS DIG with AXFR/IXFR, what is the attacker attempting to do?

• A. Send DOS commands to crash the DNS servers
• B. Perform DNS poisoning
• C. Enumerate all the users in the domain
• D. Perform a zone transfer

Answer: (D)

This question tests DNS reconnaissance through zone transfers. AXFR is a full zone transfer, and IXFR is incremental. When an attacker uses a DNS tool with these options, they are probing to see if the DNS server will reveal the entire zone data to them. If allowed, the attacker gains a complete map of the domain’s DNS records—hostnames, IP addresses, mail servers, name servers, and other resource records—which can be used for further attacks or network discovery. That’s the essence of performing a zone transfer.

Options about crashing the server, poisoning DNS, or enumerating domain users don’t align with what AXFR/IXFR attempts do; those activities target other weaknesses or goals, not the acquisition of the full DNS zone data.