Hacker News Reader

Comment by chirau | Hacker News Reader

How do you guys go about doing this? Is there some techy/reverse engineering way or you manually asking each department which domains they have?

View on HN

There are a variety of ways!

Some TLDs gives you open access to just query the DNS and do an AXFR (download the whole zone), for example the .se and .nu ccTLDs (which I happen to work for the foundation managing those): dig @zonedata.iis.se se AXFR > se.zone.txt

For some zones you could use NSEC traversal https://linux.die.net/man/1/walker

For the new gTLDs (.app, .dev, .xyz, etc, etc) there is the Centralized Zone Data Service provided by icann: https://czds.icann.org/home where you can request access to zones.

I would want to do .gov.zw

How would I know if they have open access?

So there's the possibility of some .gov TLDs being missed, like secret CIA stuff. Or the guy that commented on here that he uses a custom .gov for his home servers.

The custom .gov for his home servers doesn't exist except in his home network. You can put absolutely any domain in your home network that you want.

And the TLD .gov doesn't exist except on the internet. Similarly if there's a .gov in some CIA intranet, does it exist or not exist? That's a metaphysical question

Even if there weren't official records, you'd probably be able to get a list of most of them out of the certificate transparency logs (Obviously that would just miss out the non-https enabled ones - less of those these days).

There are also Whois DB services, that will provide you with all domains on a given TLD.

It’s probably the non SSL ones that nefarious actors would find really interesting in the list, as who knows what else is up with them.

I suspect the non ssl ones aren’t holding anything particularly useful at this stage though.

Did you open the link? The the very top says Data Source: https://manage.get.gov/api/v1/get-report/current-full. Public API provides them all, this is just a website to more easily view that data.

This info is provided by the registrar

https://get.gov/about/data/

You can download a list from here too: https://github.com/cisagov/dotgov-data/blob/main/current-ful...

They’re all listed in a csv at cisa, or at least a lot of them.

https://github.com/cisagov/dotgov-data

Reply on news.ycombinator.com