← Back to context

Comment by albert_e

7 days ago

Haven't read past the problem statement to avoid spoilers.

How difficult can it be to brute force this. (Try all possible domain names within a reasonable length)

Take help from AI while you are at it.

6 comments

albert_e

Reply
VladVladikoff  7 days ago

I think you might need api access to a nameserver to take that approach. because if you just throw 100,000,000 dns lookups at your default server they are going to throttle you.

  • Y_Y  7 days ago

    Depending on what you understand by the term "prefix" you can dramatically shrink the search space without doing any thinking.

  • quuxplusone  7 days ago

    As I understand it, yeah, there's a way to ask the .ai nameserver for its entire "zone" (the mapping from domain names to... everything else). That's a "zone transfer" a.k.a. "AXFR" request, which you can make by first locating a nameserver that knows about .ai:

        $ dig NS ai.

    Now you have the names of .ai's nameservers, and the glue records for some of them:

        ;; ADDITIONAL SECTION:
    v0n3.nic.ai.  107 IN A 199.115.155.1
    v0n3.nic.ai.  107 IN AAAA 2001:500:a3::1
    v0n0.nic.ai.  7 IN A 199.115.152.1

    Now you ask that nameserver for a zone transfer:

        $ dig AXFR ai. @199.115.155.1

    ...And it quickly says "no, not to you; I don't know you and so I'm not going to spend the bandwidth to tell you all that."

        ; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> AXFR ai. @199.115.155.1
    ;; global options: +cmd
    ; Transfer failed.

    But hey, that's how you'd ask. Now, if you were on the nameserver's whitelist, you'd see the whole zone, and the answer to the blog's puzzle would be somewhere in there. (But note that the answer is also at the end of TFA; you don't have to solve it yourself if you don't want to.)

    I wouldn't use the words "API access" to describe "permission to make AXFR requests," but yeah, it's the same general idea: if you're not on the list, you can't do the thing.

    More than I care to know about AXFR: https://cr.yp.to/djbdns/axfr-notes.html

    • tux3  7 days ago

      You can usually also ask ICANN's CZDS service for a particular zone file, if you can give them a valid reason. But in this case, they don't seem to have the ai tld.