Medved: When DNS Zone Transfers Were the Low-Hanging Fruit of Pentesting

Hook

In 2014, nearly 25% of Fortune 500 domains would accidentally expose their entire DNS infrastructure to anyone who asked nicely. Medved was built to ask at scale.

Context

DNS zone transfers (AXFR) were designed as a legitimate mechanism for synchronizing DNS records between primary and secondary nameservers. The protocol, defined in RFC 5936, allows a secondary nameserver to request a complete copy of zone data from the primary—a necessary feature for DNS redundancy. The problem? Many administrators never restricted who could request these transfers.

For penetration testers in the early 2010s, attempting zone transfers was reconnaissance gold. A successful AXFR query would dump every subdomain, mail server, and IP address in a domain's zone file—the entire infrastructure layout handed over in seconds. But the manual process was tedious: identify nameservers, craft dig or nslookup commands for each, parse results, and repeat for dozens or hundreds of targets. Medved emerged in 2014 as one of the first web-based tools to automate this workflow, providing a browser interface for batch testing and archival tracking. It represented a transition point when security testing tools started prioritizing usability and longitudinal analysis over command-line one-offs.

Technical Insight

Medved's architecture follows a straightforward PHP MVC pattern optimized for quick deployment. The core functionality lives in medved.php, which handles DNS queries through PHP's native dns_get_record() function and external dig commands via shell_exec(). Users submit domains through a jQuery-powered frontend, and the backend processes each target sequentially.

The zone transfer attempt logic is surprisingly minimal. Here's the essential flow from the source:

// Simplified from medved.php
$nameservers = dns_get_record($domain, DNS_NS);
foreach ($nameservers as $ns) {
    $cmd = "dig @{$ns['target']} {$domain} AXFR +nocmd +noall +answer";
    $output = shell_exec($cmd);
    
    if (strlen($output) > 100) {
        // Likely successful transfer
        $result = 'success';
        $timestamp = date('Y-m-d_H-i-s');
        file_put_contents(
            "archives/{$domain}_{$ns['target']}_{$timestamp}.txt",
            $output
        );
    } else {
        $result = 'refused';
    }
}

The archival mechanism is particularly interesting for its era. Rather than just displaying results transiently, Medved writes every successful zone transfer to disk with timestamps. This allows security teams to track configuration drift—when a previously locked-down zone becomes misconfigured, or conversely, when a client finally fixes an exposure after repeated pentests. The tool generates diff-friendly text files, making it possible to use standard Unix tools like diff or vimdiff to spot changes between assessment dates.

The frontend leverages Bootstrap 3 for responsive design and jQuery for AJAX interactions. Domain input parsing handles multiple delimiters (commas, spaces, line breaks), which was a thoughtful UX decision for bulk testing scenarios. Security teams could paste directly from Alexa top-1000 lists or client asset inventories without preprocessing.

One clever implementation detail: results are organized into Bootstrap tabs—one per nameserver—rather than a flat list. When testing a domain with four authoritative nameservers, you'd see four tabs showing which specific servers allowed transfers versus which refused. This granularity helps identify partially misconfigured setups where perhaps ns1.example.com refuses transfers but ns2.example.com allows them.

The keyboard shortcut integration through Shortcut.js was forward-thinking for 2014 web tools. Power users could navigate entirely via keyboard (Ctrl+Enter to submit, arrow keys between results), treating the browser interface more like a native application—unusual for security tools of that period, which typically forced mouse-heavy interactions or fell back to pure CLI.

Gotcha

The elephant in the room is PHP5, which reached end-of-life in January 2019. Running Medved on modern systems means either maintaining a legacy PHP5 environment (with all its unpatched CVE baggage) or attempting migration to PHP7/8, which breaks several deprecated functions the tool relies on. The shell_exec() approach, while simple, also introduces command injection risks if domain input sanitization fails—though zone transfer testing typically happens in controlled lab environments rather than production-facing deployments.

More fundamentally, DNS zone transfer misconfiguration rates have plummeted since 2014. Modern DNS management platforms (AWS Route53, Cloudflare, Google Cloud DNS) deny AXFR requests by default, and security awareness has improved dramatically. The technique hasn't disappeared—you'll still find exposed zone transfers in legacy infrastructure and smaller hosting providers—but the hit rate is low enough that dedicated zone transfer tools offer diminishing returns. Modern subdomain enumeration relies more on certificate transparency logs, passive DNS databases, and brute-forcing with intelligent wordlists than hoping for AXFR misconfigurations. Tools like Amass combine a dozen reconnaissance techniques, of which zone transfers are just one fallback option. Medved's single-purpose design made sense when AXFR attempts succeeded 20-30% of the time; today's <5% success rate argues for integrated multi-technique tools instead.

Verdict

Use if: You're teaching a cybersecurity course covering DNS reconnaissance history, need to demonstrate AXFR vulnerabilities in a controlled lab environment, or maintain legacy infrastructure assessments where historical zone transfer archives exist and you need to diff against past results. The archival feature remains genuinely useful for compliance scenarios requiring evidence of when misconfigurations were first detected. Skip if: You're conducting modern penetration tests (use dnsrecon, fierce, or Amass instead), need production-safe code on current PHP versions, require authentication or access controls, or want comprehensive subdomain enumeration beyond just zone transfers. The tool's unmaintained status and PHP5 dependency make it a security liability outside isolated VMs. For anything beyond nostalgia or education, contemporary alternatives provide better results with active maintenance.