The hint (using axfr) only works if the NS you're querying (ns1.foo.example in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.
Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. dig a.example.com, dig b.example.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.
仅当您连接到域的 DNS 服务器并且为您的 IP 地址启用了 AXFR 时，您才能执行此操作。 这是辅助系统用来从主系统加载区域的机制。 在过去，这不受限制，但出于安全考虑，大多数主名称服务器都有一个白名单：辅助名称服务器+几个特殊系统。
如果您使用的名称服务器允许这样做，那么您可以使用 dig 或 nslookup。
例如：
#nslookup
>ls example.com
注意：由于 dig 和其他新工具已弃用 nslookup，因此某些版本的 nslookup 不支持“ls”，尤其是 macOS X 的捆绑版本。
You can only do this if you are connecting to a DNS server for the domain -and- AXFR is enabled for your IP address. This is the mechanism that secondary systems use to load a zone from the primary. In the old days, this was not restricted, but due to security concerns, most primary name servers have a whitelist of: secondary name servers + a couple special systems.
If the nameserver you are using allows this then you can use dig or nslookup.
For example:
#nslookup
>ls example.com
NOTE: because nslookup is being deprecated for dig and other newere tools, some versions of nslookup do not support "ls", most notably macOS X's bundled version.
Under the hood, this uses the AXFR query mentioned above. You might not be allowed to do this though. In that case, you'll get a transfer failed message.
如果 DNS 服务器配置正确，您将无法获取整个域。 如果由于某种原因允许来自任何主机的区域传输，您必须向其发送正确的数据包才能发出该请求。 我怀疑这就是你所包含的挖掘声明的作用。
If the DNS server is configured properly, you won't be able to get the entire domain. If for some reason is allows zone transfers from any host, you'll have to send it the correct packet to make that request. I suspect that's what the dig statement you included does.
发布评论
评论（8）
仅当您正在查询的 NS（示例中的
ns1.foo.example）配置为允许来自您正在使用的 IP 的 AXFR 请求时，提示（使用 axfr）才有效； 这种情况不太可能发生，除非您的 IP 被配置为相关域的辅助 IP。基本上，如果您不允许使用 axfr，则没有简单的方法可以做到这一点。 这是故意的，因此唯一的解决方法是通过暴力破解（即
dig a.example.com、dig b.example.com，...），我不推荐这样做，因为它可能被视为拒绝服务攻击。The hint (using axfr) only works if the NS you're querying (
ns1.foo.examplein your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e.
dig a.example.com,dig b.example.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.如果您无法从 DNS 获取此信息（例如，您未获得授权），则另一种选择是使用 Wolfram Alpha< /a>.
在搜索框中输入域名并运行搜索。 （例如
stackexchange.com）：< /p>在顶部第三部分（名为“所有
stackexchange.com的 Web 统计信息”）中，单击子域：在子域部分，点击更多：
您将能够在那里看到子域列表。 但是，我怀疑它没有显示所有子域。
If you can't get this information from DNS (e.g. you aren't authorized) then one alternative is to use Wolfram Alpha.
Enter the domain into the search box and run the search. (E.g.
stackexchange.com):In the 3rd section from the top (named "Web statistics for all of
stackexchange.com") click Subdomains:In the Subdomains section, click More:
You will be able to see a list of subdomains there. However, I suspect it does not show all subdomains.
免费的robotex工具可以让你做到这一点，但它们会让你首先输入域的ip：
robotex tools which are free will let you do this but they make you enter the ip of the domain first:
仅当您连接到域的 DNS 服务器并且为您的 IP 地址启用了 AXFR 时，您才能执行此操作。 这是辅助系统用来从主系统加载区域的机制。 在过去，这不受限制，但出于安全考虑，大多数主名称服务器都有一个白名单：辅助名称服务器+几个特殊系统。
如果您使用的名称服务器允许这样做，那么您可以使用 dig 或 nslookup。
例如：
注意：由于 dig 和其他新工具已弃用 nslookup，因此某些版本的 nslookup 不支持“ls”，尤其是 macOS X 的捆绑版本。
You can only do this if you are connecting to a DNS server for the domain -and- AXFR is enabled for your IP address. This is the mechanism that secondary systems use to load a zone from the primary. In the old days, this was not restricted, but due to security concerns, most primary name servers have a whitelist of: secondary name servers + a couple special systems.
If the nameserver you are using allows this then you can use dig or nslookup.
For example:
NOTE: because nslookup is being deprecated for dig and other newere tools, some versions of nslookup do not support "ls", most notably macOS X's bundled version.
dig example.com soadig @ns.SOA.example example.com axfrdig example.com soadig @ns.SOA.example example.com axfr您可以使用：
在幕后，这使用上面提到的
AXFR查询。 但您可能不被允许这样做。 在这种情况下，您将收到传输失败消息。You can use:
Under the hood, this uses the
AXFRquery mentioned above. You might not be allowed to do this though. In that case, you'll get atransfer failedmessage.如果 DNS 服务器配置正确，您将无法获取整个域。 如果由于某种原因允许来自任何主机的区域传输，您必须向其发送正确的数据包才能发出该请求。 我怀疑这就是你所包含的挖掘声明的作用。
If the DNS server is configured properly, you won't be able to get the entire domain. If for some reason is allows zone transfers from any host, you'll have to send it the correct packet to make that request. I suspect that's what the dig statement you included does.
在 Windows nslookup 中，该命令
将子域列表存储在 outfile.txt 中，
现在很少有域允许这样做
In Windows
nslookupthe command iswhich stores the subdomain list in
outfile.txtfew domains these days allow this