Tags: dns 

Rating:

The titie "Digging for Soup" means `dig` command.

try `dig nicebowlofsoup.com` (I'm in a restricted network that doesn't allow TCP 53, so I use [digwebinterface.com](http://digwebinterface.com) and shell which EasyCTF provided):

$ dig nicebowlofsoup.com
...
;; AUTHORITY SECTION:
nicebowlofsoup.com. 3600 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlofsoup.com. 2018021205 28800 7200 604800 86400

Hmm... try requesting TXT records:

$ dig nicebowlofsoup.com txt
;; ANSWER SECTION:
nicebowlofsoup.com. 100 IN TXT "Close, but no cigar... where else could it be? hint: the nameserver's IP is 159.65.43.62"

So probably I have to ask `159.65.43.62` something.
And here's the hint they provided: `How do slave zones know when updates are made to the master?`
I am not familiar with DNS so I googled for a moment and found that slave zones use **AXFR** request to get zone information.

$ dig @159.65.43.62 nicebowlofsoup.com axfr
; <<>> DiG 9.10.3-P4-Ubuntu <<>> @159.65.43.62 nicebowlofsoup.com axfr
; (1 server found)
;; global options: +cmd
nicebowlofsoup.com. 86400 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlof
soup.com. 2018021205 28800 7200 604800 86400
easyctf.nicebowlofsoup.com. 10 IN TXT "easyctf{why_do_i_even_have_this_domain}"
nicebowlofsoup.com. 100 IN TXT "Close, but no cigar... where else could it b
e? hint: the nameserver's IP is 159.65.43.62"
nicebowlofsoup.com. 86400 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlof
soup.com. 2018021205 28800 7200 604800 86400

The FLAG is: `easyctf{why_do_i_even_have_this_domain}`

Original writeup (http://sei0o.hateblo.jp/entry/2018/02/24/205253).