> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/interesting-exercises/finding-flag-in-dns-server.md).

# Finding flag in DNS server

### Objectives

1. Identify the hosts listening on DNS port
2. Find the public domain DNS server and domain name
3. Find flag from DNS server's TXT record

### Identify hosts listening on DNS port

<figure><img src="/files/RvapXpgmwHgEtZac1gT3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/HB9jpBIpdzXF90ZfNyRZ" alt=""><figcaption></figcaption></figure>

### Change the DNS server

<figure><img src="/files/EzquFJwoo977dyD6NZ8p" alt=""><figcaption></figcaption></figure>

### Tests the domain for a zone transfer

<figure><img src="/files/IfOH2DTTWJb2CX49JwhR" alt=""><figcaption></figcaption></figure>