Sample code

• Get SOA record

  import dns.resolver
  
  SOA_records = dns.resolver.resolve('zonetransfer.me', 'SOA')
  for SOA in SOA_records:
      print("[*] Found SOA record: {}".format(SOA))
  

• 

• Get A record

  import dns.resolver
  
  A_records = dns.resolver.resolve('zonetransfer.me', 'A')
  for A in A_records:
    print("[*] Found A record: {}".format(A))
  

• 

• Get NS record

  import dns.resolver
  
  NS_records = dns.resolver.resolve('zonetransfer.me', 'NS')
  for NS in NS_records:
      print("[*] Found NS record: {}".format(NS))
  

• 

• AXFR

  • use NS record IP found host

   import dns.resolver
   import dns.zone
  
   NS_records = dns.resolver.resolve('zonetransfer.me', 'NS')
   for NS in NS_records:
       print("[*] NS: {}".format(NS))
  
       ns_ip = dns.resolver.resolve(NS.target, 'A')
       for ip in ns_ip:
           print("[*] IP for {} is {}".format(server, ip))
           zone = dns.zone.from_xfr(dns.query.xfr(ip, 'zonetransfer.me'))
           for host in zone:
               print("[*] Found Host: {}.zonetransfer.me".format(host))
  

  • 
  • 

• 參考資料

  • https://gist.github.com/gothburz/f9805f0b10637e69dcb887d3292abee3
  • https://programtalk.com/python-examples/dns.zone.from_xfr/