Tags: dns
Rating:
The titie "Digging for Soup" means `dig` command.
try `dig nicebowlofsoup.com` (I'm in a restricted network that doesn't allow TCP 53, so I use [digwebinterface.com](http://digwebinterface.com) and shell which EasyCTF provided):
$ dig nicebowlofsoup.com
...
;; AUTHORITY SECTION:
nicebowlofsoup.com. 3600 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlofsoup.com. 2018021205 28800 7200 604800 86400
Hmm... try requesting TXT records:
$ dig nicebowlofsoup.com txt
;; ANSWER SECTION:
nicebowlofsoup.com. 100 IN TXT "Close, but no cigar... where else could it be? hint: the nameserver's IP is 159.65.43.62"
So probably I have to ask `159.65.43.62` something.
And here's the hint they provided: `How do slave zones know when updates are made to the master?`
I am not familiar with DNS so I googled for a moment and found that slave zones use **AXFR** request to get zone information.
$ dig @159.65.43.62 nicebowlofsoup.com axfr
; <<>> DiG 9.10.3-P4-Ubuntu <<>> @159.65.43.62 nicebowlofsoup.com axfr
; (1 server found)
;; global options: +cmd
nicebowlofsoup.com. 86400 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlof
soup.com. 2018021205 28800 7200 604800 86400
easyctf.nicebowlofsoup.com. 10 IN TXT "easyctf{why_do_i_even_have_this_domain}"
nicebowlofsoup.com. 100 IN TXT "Close, but no cigar... where else could it b
e? hint: the nameserver's IP is 159.65.43.62"
nicebowlofsoup.com. 86400 IN SOA ns1.nicebowlofsoup.com. hostmaster.nicebowlof
soup.com. 2018021205 28800 7200 604800 86400
The FLAG is: `easyctf{why_do_i_even_have_this_domain}`