One dig Command That Exposed an Entire Company's Infrastructure

#DNS Is the Most Neglected Attack Surface in Every Organization#link

Nobody patches their DNS server. Nobody reviews their zone transfer configuration. Nobody audits their CNAME records for dangling references to decommissioned services. DNS is set up once, during the initial infrastructure build, and then forgotten. It just works. Until someone like you runs dig AXFR against it and downloads the entire namespace. Every subdomain. Every internal IP. Every service endpoint.

Eight records. Three internal subdomains with their IPs. admin, hr, support. You now know the internal IP scheme (10.129.110.x), the naming convention, and exactly which hosts to target next. One command. No authentication. No exploit. Just a misconfigured DNS server that allows zone transfers to anyone who asks.

Subdomain Takeover: Claiming Abandoned Infrastructure

Here is the scenario. A company creates support.inlanefreight.com and points it to an AWS S3 bucket via a CNAME record. Six months later, they delete the S3 bucket to save costs. But they never remove the CNAME record from DNS. The CNAME still points to inlanefreight.s3.amazonaws.com. That bucket name is now available. You create it. You now own support.inlanefreight.com.

The alias points to an S3 bucket. Visit the URL and you get a NoSuchBucket error. That error is your confirmation. The bucket does not exist. The CNAME is dangling. Create the bucket with that exact name in your AWS account. Upload an index.html. You now control a subdomain of the target organization. Phishing from their domain. Cookie theft. CORS abuse. CSP bypass. All from a forgotten DNS record.

DNS attacks are quiet. No failed login attempts. No IDS alerts. No account lockouts. A zone transfer looks like normal DNS traffic. A subdomain takeover happens entirely within your own cloud account. The target never knows until you include it in the report. This is the most underappreciated attack category in penetration testing. Check DNS on every engagement. You will find something.