Zone Allocation

Zone Allocation

There are two ways in which a domain tree can be divided into zones:
• By Class
• By “cuts”
These two methods, particularly allocation by “cuts”, serve to illustrate
further the difference between domains and zones.
Allocation by Class
To allocate zones by class is the simpler of the two methods. Each class
implemented within a domain is considered to be one zone, and will
contain the entirety of the domain tree, organized, delegated, and
maintained separately from all other classes.
Classes can be created for a domain, but as standard, there are only two
as defined by rfc 1034:
• IN This is the Internet class. It is the default class and used
throughout the Internet.

• CH This is the Chaos class. It is not widely used, originating as an
experimental class from the Massachusetts Institute of Technology.
Allocation by “Cuts”
This method of “cutting up” the domain space is perhaps the more
widely used within larger trees where there are too many hosts and
subdomains to be served by just one zone's name servers. The domain
tree is cut between adjacent nodes, e.g. between example and
development; the nodes or domains on one side belonging to a separate
domain to those nodes or domains on the other side.
• First zone - Contains the example.com domain, the advertising
subdomain and all its respective subdomains
• Second zone - Contains the development domain and all its
subdomains.
Each zone will have its own authoritative name server and secondary
name server.

Difference between a Zone and a Domain

Difference between a Zone and a Domain

The difference between a zone and a domain is often poorly
understood. Consider the domain tree shown in Figure 1. It shows the
example.com domain with subdomains development.example.com and
advertising.example.com. The development domain has three
subdomains and advertising another two.


The root domain, example.com is the parent to the development and
advertising domains, each of which is a subdomain of example.com.
These two subdomains are themselves parent domains to their own set
of subdomains, namely, resources, documentation, coders, design and
sales. Thus, the fictitious company, example.com, is divided up into
multiple domains allowing easier administration and greater
geographical versatility.
In addition to the primary and backup domain controllers that exist in
each domain, there will typically be one or more Domain Name System
(DNS) servers, or name servers, responsible for the domain. However,
unlike domain controllers, there does not need to be a name server for

each domain, instead name servers are allocated zones that can
comprise of one or many domains. Thus a domain cannot contain a
zone but a zone can contain one or more domains, the two being
definable in the following way:
• A domain represents one branch of the DNS name space
• A zone is a contiguous portion of the name space.
All the hosts within a zone have their name and IP address stored on
the primary name server and are configured to look to this or a
secondary name server when name resolution is required.
Name servers responsible for a zone are said to be authoritative for that
zone. The primary name server will always hold the most current zone
file and secondary name servers are typically configured to send zone
transfer queries to this server though another secondary name server
could be used instead.

Zone Transfer

Zone Transfer

Introduction

Perhaps the most popular method for gathering information about all
the computers within a domain is to request a zone transfer from the
authoritative name server for that domain. The name server will hold
information on all the computers for which it is responsible, listing
hostname against IP address.
It is strongly recommended, for reasons of load balancing and fault
tolerance, that there is more than one name server.
The main name server is called the primary name server, and all
subsequent name servers are secondary name servers. Either a primary
or secondary name server can be queried for name resolution, so it is
necessary that the information each name server has is current. To
ensure this is the case, when a secondary name server is started and at
regular, specifiable intervals thereafter, it requests a complete listing of
the computers it is responsible for from the primary name server. The
process of requesting and receiving this information is a zone transfer.

Gathering Technical Information

Gathering Technical Information

Introduction
Having gathered all the necessary background information as
described in the previous module, the next step is to collect information
of a more technical nature. With this information potential targets can
be identified within the remote network. This module will introduce
the following topics:
• Zone transfers - Covering a definition of zone transfers and their
importance.
• Tools - Covering the most common tools used to gain technical
information.
Previously, the information gathered has been largely background on
the company and who are the staff within it responsible for key areas
such as network administration and maintenance. The technical
information discussed and gathered in this module will include the
following categories:
• Names and IP addresses of DNS servers.
• Names and IP addresses of mail exchange servers.
• Names and IP addresses of other servers, e.g. web servers.
• Names and IP addresses of hosts.
• Resource Records required for gaining such information.

News Sites, Newsgroups and Search Engines

News Sites, Newsgroups and Search Engines

News Sites
Searching through news sites such as CNN (www.cnn.com) or the BBC
(www.bbc.co.uk) can yield the latest press releases made by a company
and tell of potential or current business partners, leading or recently
sacked or discredited employees, and of course a little more
background information.
Newsgroups
Searching through the news groups such as Usenet (www.usenet.com)
can also be productive. If it is known that certain employees regularly
post to a group then they may not be too discreet in what they post or
leading questions could be posted to induce them to respond with
“inside” knowledge. In addition to this a disgruntled employee may
post sensitive company information to a news group for anyone to take
advantage of.
Search Engines
Search engines can return articles written about the company or sites
containing information relating to weaknesses and vulnerabilities in
software that they may be running or products they market. Searching
for vulnerabilities will be covered in more depth in a later section.

Using Sam Spade to Parse a Website

Using Sam Spade to Parse a Website
One of the many functions that Sam Spade performs is scraping or
crawling a website. It will parse all the HTML code looking for
characters, words and string patterns specified by the user. The search
capabilities are extremely versatile, and provides such capabilities as:


• Mirroring the website to the local hard disk. This function could
facilitate a manual inspection of the website. It must be noted,
however, that some website administrators can detect and
disapprove of such an action.
• Apply a general filter to the pages that are parsed, e.g. only .html,
.asp and .txt pages. The website may contain types of pages or files
that do not offer any searchable information, so only those that can
be successfully parsed are un-filtered.
• Parse website for e-mail addresses. In the comment fields or as part
of the contact information, the author may have written an e-mail
address. This can potentially provide a username for future login
attempts and brute force attacks.
• Search for images on this or other servers. If the website is mirrored
elsewhere, whether on this or another servers, then there may exist
additional information from these alternate sources or a different
server may have a badly configured security policy.
• Search for links to this or other servers. The links can provide
information relating to the location of significant files and
directories on a server.
• Parse for hidden form values. Some pages use predefined values
and constants for such tasks as default authentication to other
servers. Obviously, these are not displayed on a web page but can be
found by searching through the HTML source.
• Parse for a user-defined text string. This option includes the ability
to specify a string exactly or use a combination of wildcards and
user-definable character sets.

Company Homepage

Company Homepage
The company’s website may not yield any sensitive information when
viewed through a browser, however, if the HTML source code is
viewed more may be derived. It is possible to read through all the
HTML code manually, hoping to find useful information or to use a tool
written specifically for the task. An example of such a tool is Sam
Spade, found on its home page, www.samspade.org. The
downloadable executable is compiled to run on a Windows operating
system though there is also a reduced functionality web-based version
that can be accessed by any Internet client.
Information Hidden in HTML
Potentially, any amount of information can be located in the source
code for a website. It could be as simple as a comment placed in the
code by the author or auto generated comments and code that identify
the software package used to create or serve the website. The following
list identifies typical information found:
• E-mail addresses for key staff within the target company or the
website author(s).
• Usernames for key staff or author(s).
• Passwords for any of the above.
• The software package used to create the website.
• The software that the web server is running.
• The location of CGI scripts and other significant files on the server.
• Authentication details for communications between this and other
servers.
• Other servers that mirror this website.

EDGAR Database

EDGAR Database
EDGAR, the Electronic Data Gathering, Analysis and Retrieval system,
collects, validates and archives submissions made by companies to the
U.S. Securities and Exchange Commission (SEC). From 1996 all public
domestic companies in the U.S. were required to submit filings to the
SEC. These are searchable through EDGAR.
The EDGAR database can contain a considerable amount of data
relating to a company but it is not all useful in this context. The
information that can be obtained from EDGAR and may prove to be
useful includes:
• Principal employees.
• Main Shareholders.
• Key staff and their positions.
• Business mergers and partners.
• Quarterly and annual profits.
Stock Exchange Websites
The various stock exchanges that exist around the world, e.g. NASDAQ
(www.nasdaq.com), provide information about a company such that its
investors, whether current or prospective, can find out more about it.
As with other online resources, there is likely to be more information
than is necessarily required in this context. The stock exchanges
provide the following types of information:
• Press releases.
• Physical location of the company.
• Current and previous stock price.
• Who analyses the company to provide recommendations.
• Predictions appertaining to the company's future performance.

Information that can be gleaned from Whois

Information that can be gleaned from Whois
There is a variety of information that is returned from the resources
listed above. Some is unique to the particular resource whilst other
information will be confirmed by almost all the databases. The
information most commonly retrieved includes the following:
• Names of selected company staff and key personnel (e.g. Network
engineers, systems administrators).
• Personal information about the staff and key personnel listed above
(e.g. Contact information).
• Geographic location of the company.
• Name Servers for the company.
• IP addresses for the Name Servers
• Reserved IP addresses or IP blocks for the company.
• The ISP that the company is using.
• The date when the company website was last updated.
• Business partners.

Performing Whois Searches

Performing Whois Searches
The organizations responsible for maintaining these large databases of
domain name and IP number registration allow them to be searched
using a Whois query.
1. Command line Whois query
It is possible to query Whois databases using the command line
interface on a standard UNIX or LINUX based operating system.
Some examples as to how this can be done are given below:
whois -h whois.internic.net target.co.uk
whois -h whois.arin.net target.com
whois -h whois.networksolutions.net target.com
whois -h whois.nic.uk target.co.uk
2. Dedicated program
There are programs to query Whois databases available on many
platforms, one of the most popular Windows and Web-based
programs is Sam Spade available from www.samspade.org.
3. Web based Whois query
A Whois query can also be performed online. By visiting the
appropriate organisation’s website, depending on the type of
information required, it is possible to follow hyperlinks to a webbased
search tool that will directly query their database. Further
information relating to which organisation’s website to visit will
now be given.
Websites that provide Whois databases
• Domain Name query
To find out information about the company or individual within a
company that has registered the domain name, useful websites
include the following:
• www.internic.net - Provides information on .com, .net, .org, .edu
domains.
• www.nic.uk - Provides information on .uk domains.

• www.networksolutions.net - .com, .net and .org domain names
can be checked to see if they are already registered or a standard
whois search can be performed.
• www.nic.mil - Provides information from the Department of
Defense’s database on .mil domains and other military IT
hardware.
• IP Block query
To find out the IP blocks that a company has registered and who
owns the encompassing IP blocks, the websites for the three RIR’s,
given earlier, should be consulted and the hyperlinks to the Whois
search tools, followed.

Sources of Information

Sources of Information

The useful online resources that will be considered for gathering
information about the target company, are:
• Regional Internet Registries (RIR's).
• Whois search.
• EDGAR database.
• Stock Exchange websites.
• Company homepage.
• News sites, newsgroups and search engines.
Regional Internet Registries (RIR’s)
To find out the IP blocks that a company has reserved, one of the three
RIR's can be queried.
• www.arin.net - covering North and South America and sub-
Saharan Africa.
• www.apnic.net - covering Asia Pacific.
• www.ripe.net - covering Europe, the Middle East and parts of
Africa.
Whois Search
The target company will most often have a website on the Internet. The
domain name that is used for the website, e.g. www.iss.net, needs to
have been registered with an ICANN accredited domain name
registrar.
In addition to this, it is likely that the company will have a permanent
Internet connection. This means that they will have registered one or
more IP addresses with a RIR. A Whois search can be performed to
retrieve information from the relevant databases.