dns-zone-audit

DNS Zone Audit 軽量なBashベースのセキュリティツールで、DNSゾーン転送の設定ミス（AXFR）をテストします。CVE-1999-0532に関連しています。 このスクリプトは、ドメインの権威ネームサーバーに問い合わせ、完全なゾーン転送を試みます。成功した場合、内部インフラやレコードを露出させる重大なDNS設定ミスを示します。 特徴 対話的なドメイン入力（単一または複数ターゲット） ファイル入力によるバッチスキャン 自動的な権威ネームサーバーの検出 TCP経由のAXFRテスト 明確で色分けされた出力 最小限の依存関係 要件 bash dig（dnsutils または...

Subrake

Subrake 🦅 一个DNS自动化扫描器和工具（区域传输、DNS区域接管、子域名接管）。 背景 📈 Subrake最初是我个人的子域名枚举项目，现在已发展成一个详细的DNS扫描工具，可以一次性帮助你识别区域传输 、DNS区域接管 和子域名接管 。 区域传输已经存在多年，如果由于某种原因在域名上启用，将允许另一方枚举区域中的所有记录。它们实际上用于当所有者将域名从一个提供商转移到另一个提供商时。 子域名接管与字面意思不同，它是对子域名所指服务的接管 。该服务需要已过时或未被使用。...

webstor

WebStor 조직 내 취약한 웹 기술의 신속한 식별 WebStor는 MIT 라이선스 하에 Python으로 구현된 도구로, 조직의 모든 네트워크에 걸쳐 모든 웹사이트를 신속하게 열거하고, 해당 응답을 저장하며, 제로데이 취약점이 있는 것과 같은 알려진 웹 기술 및 버전을 쿼리하기 위한 도구입니다. 특히 중대형 규모의 분산 관리 조직에서 여러 관리자가 각기 다른 부서와 네트워크에 배포한 모든 웹 기술을 추적하는 것이 거의 불가능한 고유한 문제를 해결하기 위해 설계되었습니다. WebStor는 다음 작업을 수행하여 목표를 달성합니다...

dns-zone-transfer-test

DNS 영역 전송 테스트 DNS도메인 이름 시스템 영역 전송 테스트를 자동화합니다. 주어진 도메인의 네임서버를 자동으로 찾아 영역 전송을 테스트하고, 성공하면 확인된 A 레코드를 표준 출력에 출력합니다. 사용법 root@kitploit: dztt zonetransfer.me dztt -f domains.txt dztt -n 1.1.1.1 zonetransfer.me 요구사항 root@kitploit: git = 2.36.0 python = 3.9 pip = 20.3.4 시스템 설치 없이 사용하기 필요한 시스템 패키지가 설치되어...

czds

CZDS 什么是 CZDS？ 每个顶级域（TLD）由一个注册局维护，该注册局还管理一份公开可用的二级域（SLD）列表，以及将这些域名解析为互联网协议（IP）地址所需的详细信息。 注册局的区域数据包含域名、相关名称服务器名称以及这些名称服务器的 IP 地址之间的映射。每当信息发生变化，或者添加或移除域名时，注册局都会为其相应的 TLD 更新这些详细信息。 每个注册局将其区域数据保存在一个名为 Zone File 的文本文件中，该文件每 24 小时更新一次。 功能 从 ICAAN 和其他机构托管的根 DNS 服务器检索集中式区域传送文件...

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters. The stronger variant is in record. An authenticated customer with...

CVE-2026-54543

In Froxlor before 2.3.8, an authenticated customer with DNS-zone permissions can inject crafted record or type field values (line delimiters, tabs, semicolons) into lib/Froxlor/Api/Commands/DomainZones.php, which DnsEntry.php serializes into a BIND zone file, creating extra resource-record lines ...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-71194

A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The handlenotify method performs zone lookups without poolid scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage lay...

SUSE CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the transfer. An attacker can cause a panic and disrupt DNS service availability by sending an AXFR request to a zone configured with k8sexternal headless-service zone transfers when a headless service endpoint...

CVE-2026-62994

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared port...

EUVD-2026-45017

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone

A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service DoS for legitimate users...

PT-2026-44908

Name of the Vulnerable Software and Affected Versions Froxlor versions 2.3.6 and earlier Description DNS record content is concatenated directly into bind9 zone files in the DnsEntry.php file, which allows for zone file injection. The issue stems from incomplete validation of LOC, RP, SSHFP, and...

bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone

A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service DoS for legitimate users...

AlmaLinux 9 : bind (ALSA-2026:8075)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:8075 advisory. bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block directly from the...

CVE-2025-8677 Resource exhaustion via malformed DNSKEY handling

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1...