Skip to content

mandatoryprogrammer/NorthKoreaDNSLeak

BranchesTags

Repository files navigation

North Korean Flag

North Korea .kp TLD Zone Data

On Sept 19, 2016 at approximately 10:00PM (PDT), one of North Korea's top level nameservers was accidentally configured to allow global DNS zone transfers. This allows anyone who performs an AXFR (zone transfer) request to the country's ns2.kptc.kp nameserver to get a copy of the nation's top level DNS data. This was detected by the TLDR Project - an effort to attempt zone transfers against all top level domain (TLD) nameservers every three hours and keep a running Github repo with the resulting data. This data gives us a better picture of North Korea's domains and top level DNS.

Click here for the commit showing this incident.

As of the time of this writing, zone transfers are still enabled for multiple .kp top level domains via ns2.kptc.kp.

Update: North Korea has now patched this issue, however this project will continue to scan the Internet for future slip-ups just like this one.

PoC

dig AXFR kp. @ns2.kptc.kp

.kp Domains

airkoryo.com.kp.
cooks.org.kp.
friend.com.kp.
gnu.rep.kp.
kass.org.kp.
kcna.kp.
kiyctc.com.kp.
knic.com.kp.
koredufund.org.kp.
korelcfund.org.kp.
korfilm.com.kp.
ma.gov.kp.
masikryong.com.kp.
naenara.com.kp.
nta.gov.kp.
portal.net.kp.
rcc.net.kp.
rep.kp.
rodong.rep.kp.
ryongnamsan.edu.kp.
sdprk.org.kp.
silibank.net.kp.
star-co.net.kp.
star-di.net.kp.
star.co.kp.
star.edu.kp.
star.net.kp.
vok.rep.kp.

.kp Zone File Data

; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> AXFR kp. @ns2.kptc.kp. +nocomments +nocmd +noquestion +nostats +time=15
;; global options: +cmd
kp.         432000  IN  SOA ns1.kptc.kp. root.kptc.kp. 2013083001 28800 86400 1209600 86400
kp.         432000  IN  NS  ns1.kptc.kp.
kp.         432000  IN  NS  ns2.kptc.kp.
kp.         432000  IN  NS  ns3.kptc.kp.
co.kp.          432000  IN  NS  ns1.co.kp.
co.kp.          432000  IN  NS  ns2.co.kp.
ns1.co.kp.      432000  IN  A   175.45.176.15
ns2.co.kp.      432000  IN  A   175.45.176.16
com.kp.         432000  IN  NS  ns1.com.kp.
com.kp.         432000  IN  NS  ns2.com.kp.
ns1.com.kp.     432000  IN  A   175.45.176.15
ns2.com.kp.     432000  IN  A   175.45.176.16
edu.kp.         432000  IN  NS  ns1.edu.kp.
edu.kp.         432000  IN  NS  ns2.edu.kp.
ns1.edu.kp.     432000  IN  A   175.45.176.15
ns2.edu.kp.     432000  IN  A   175.45.176.16
gov.kp.         432000  IN  NS  ns1.gov.kp.
gov.kp.         432000  IN  NS  ns2.gov.kp.
ns1.gov.kp.     432000  IN  A   175.45.176.15
ns2.gov.kp.     432000  IN  A   175.45.176.16
kcna.kp.        432000  IN  NS  ns1.kcna.kp.
kcna.kp.        432000  IN  NS  ns2.kcna.kp.
ns1.kcna.kp.        432000  IN  A   175.45.176.8
ns2.kcna.kp.        432000  IN  A   175.45.176.9
ns1.kptc.kp.        432000  IN  A   175.45.176.15
ns2.kptc.kp.        432000  IN  A   175.45.176.16
net.kp.         432000  IN  NS  ns1.net.kp.
net.kp.         432000  IN  NS  ns2.net.kp.
ns1.net.kp.     432000  IN  A   175.45.176.15
ns2.net.kp.     432000  IN  A   175.45.176.16
org.kp.         432000  IN  NS  ns1.org.kp.
org.kp.         432000  IN  NS  ns2.org.kp.
ns1.org.kp.     432000  IN  A   175.45.176.15
ns2.org.kp.     432000  IN  A   175.45.176.16
rep.kp.         432000  IN  NS  ns1.rep.kp.
rep.kp.         432000  IN  NS  ns2.rep.kp.
ns1.rep.kp.     432000  IN  A   175.45.176.15
ns2.rep.kp.     432000  IN  A   175.45.176.16
kp.         432000  IN  SOA ns1.kptc.kp. root.kptc.kp. 2013083001 28800 86400 1209600 86400

.co.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR co.kp. @ns2.kptc.kp
;; global options: +cmd
co.kp.          432000  IN  SOA ns1.co.kp. root.co.kp. 2013082900 28800 86400 1209600 86400
co.kp.          432000  IN  NS  ns1.co.kp.
co.kp.          432000  IN  NS  ns2.co.kp.
ns1.co.kp.      432000  IN  A   175.45.176.15
ns2.co.kp.      432000  IN  A   175.45.176.16
star.co.kp.     432000  IN  NS  ns1.star.co.kp.
star.co.kp.     432000  IN  NS  ns2.star.co.kp.
ns1.star.co.kp.     432000  IN  A   175.45.176.15
ns2.star.co.kp.     432000  IN  A   175.45.176.16
co.kp.          432000  IN  SOA ns1.co.kp. root.co.kp. 2013082900 28800 86400 1209600 86400
;; Query time: 437 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:28:46 2016
;; XFR size: 10 records (messages 1, bytes 241)

.com.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR com.kp. @ns2.kptc.kp
;; global options: +cmd
com.kp.         432000  IN  SOA ns1.com.kp. root.com.kp. 2013112203 28800 86400 1209600 86400
com.kp.         432000  IN  NS  ns1.com.kp.
com.kp.         432000  IN  NS  ns2.com.kp.
airkoryo.com.kp.    432000  IN  NS  ns1.airkoryo.com.kp.
airkoryo.com.kp.    432000  IN  NS  ns2.airkoryo.com.kp.
ns1.airkoryo.com.kp.    432000  IN  A   175.45.176.8
ns2.airkoryo.com.kp.    432000  IN  A   175.45.176.9
friend.com.kp.      432000  IN  NS  ns1.friend.com.kp.
friend.com.kp.      432000  IN  NS  ns2.friend.com.kp.
ns1.friend.com.kp.  432000  IN  A   175.45.176.8
ns2.friend.com.kp.  432000  IN  A   175.45.176.9
kiyctc.com.kp.      432000  IN  NS  ns1.kiyctc.com.kp.
kiyctc.com.kp.      432000  IN  NS  ns2.kiyctc.com.kp.
ns1.kiyctc.com.kp.  432000  IN  A   175.45.176.8
ns2.kiyctc.com.kp.  432000  IN  A   175.45.176.9
knic.com.kp.        432000  IN  NS  ns1.knic.com.kp.
knic.com.kp.        432000  IN  NS  ns2.knic.com.kp.
ns1.knic.com.kp.    432000  IN  A   175.45.176.8
ns2.knic.com.kp.    432000  IN  A   175.45.176.9
korfilm.com.kp.     432000  IN  NS  ns1.korfilm.com.kp.
korfilm.com.kp.     432000  IN  NS  ns2.korfilm.com.kp.
ns1.korfilm.com.kp. 432000  IN  A   175.45.176.8
ns2.korfilm.com.kp. 432000  IN  A   175.45.176.9
masikryong.com.kp.  432000  IN  NS  ns1.masikryong.com.kp.
masikryong.com.kp.  432000  IN  NS  ns2.masikryong.com.kp.
ns1.masikryong.com.kp.  432000  IN  A   175.45.176.8
ns2.masikryong.com.kp.  432000  IN  A   175.45.176.9
naenara.com.kp.     432000  IN  NS  ns1.naenara.com.kp.
naenara.com.kp.     432000  IN  NS  ns2.naenara.com.kp.
ns1.naenara.com.kp. 432000  IN  A   175.45.176.8
ns2.naenara.com.kp. 432000  IN  A   175.45.176.9
ns1.com.kp.     432000  IN  A   175.45.176.15
ns2.com.kp.     432000  IN  A   175.45.176.16
com.kp.         432000  IN  SOA ns1.com.kp. root.com.kp. 2013112203 28800 86400 1209600 86400
;; Query time: 252 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:29:01 2016
;; XFR size: 34 records (messages 1, bytes 700)

edu.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR edu.kp. @ns2.kptc.kp
;; global options: +cmd
edu.kp.         432000  IN  SOA ns1.edu.kp. root.edu.kp. 2013082903 28800 86400 1209600 86400
edu.kp.         432000  IN  NS  ns1.edu.kp.
edu.kp.         432000  IN  NS  ns2.edu.kp.
ns1.edu.kp.     432000  IN  A   175.45.176.15
ns2.edu.kp.     432000  IN  A   175.45.176.16
ryongnamsan.edu.kp. 432000  IN  NS  ns1.ryongnamsan.edu.kp.
ryongnamsan.edu.kp. 432000  IN  NS  ns2.ryongnamsan.edu.kp.
ns1.ryongnamsan.edu.kp. 432000  IN  A   175.45.176.8
ns2.ryongnamsan.edu.kp. 432000  IN  A   175.45.176.9
star.edu.kp.        432000  IN  NS  ns1.star.edu.kp.
ns1.star.edu.kp.    432000  IN  A   175.45.179.76
edu.kp.         432000  IN  SOA ns1.edu.kp. root.edu.kp. 2013082903 28800 86400 1209600 86400
;; Query time: 1433 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:29:19 2016
;; XFR size: 12 records (messages 1, bytes 288)

gov.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR gov.kp. @ns2.kptc.kp
;; global options: +cmd
gov.kp.         432000  IN  SOA ns1.gov.kp. root.gov.kp. 2013082901 28800 86400 1209600 86400
gov.kp.         432000  IN  NS  ns1.gov.kp.
gov.kp.         432000  IN  NS  ns2.gov.kp.
ma.gov.kp.      432000  IN  NS  ns1.ma.gov.kp.
ma.gov.kp.      432000  IN  NS  ns2.ma.gov.kp.
ns1.ma.gov.kp.      432000  IN  A   175.45.176.8
ns2.ma.gov.kp.      432000  IN  A   175.45.176.9
ns1.gov.kp.     432000  IN  A   175.45.176.15
ns2.gov.kp.     432000  IN  A   175.45.176.16
nta.gov.kp.     432000  IN  NS  ns1.nta.gov.kp.
nta.gov.kp.     432000  IN  NS  ns2.nta.gov.kp.
ns1.nta.gov.kp.     432000  IN  A   175.45.176.8
ns2.nta.gov.kp.     432000  IN  A   175.45.176.9
gov.kp.         432000  IN  SOA ns1.gov.kp. root.gov.kp. 2013082901 28800 86400 1209600 86400
;; Query time: 1638 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:29:36 2016
;; XFR size: 14 records (messages 1, bytes 312)

net.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR net.kp. @ns2.kptc.kp
;; global options: +cmd
net.kp.         432000  IN  SOA ns1.net.kp. root.net.kp. 2013082901 28800 86400 1209600 86400
net.kp.         432000  IN  NS  ns1.net.kp.
net.kp.         432000  IN  NS  ns2.net.kp.
ns1.net.kp.     432000  IN  A   175.45.176.15
ns2.net.kp.     432000  IN  A   175.45.176.16
portal.net.kp.      432000  IN  NS  ns1.portal.net.kp.
portal.net.kp.      432000  IN  NS  ns2.portal.net.kp.
ns1.portal.net.kp.  432000  IN  A   175.45.176.8
ns2.portal.net.kp.  432000  IN  A   175.45.176.9
rcc.net.kp.     432000  IN  NS  ns1.rcc.net.kp.
rcc.net.kp.     432000  IN  NS  ns2.rcc.net.kp.
ns1.rcc.net.kp.     432000  IN  A   175.45.176.8
ns2.rcc.net.kp.     432000  IN  A   175.45.176.9
silibank.net.kp.    432000  IN  NS  ns1.silibank.net.kp.
silibank.net.kp.    432000  IN  NS  ns2.silibank.net.kp.
ns1.silibank.net.kp.    432000  IN  A   175.45.176.8
ns2.silibank.net.kp.    432000  IN  A   175.45.176.9
star.net.kp.        432000  IN  NS  ns1.star.net.kp.
star.net.kp.        432000  IN  NS  ns2.star.net.kp.
ns1.star.net.kp.    432000  IN  A   175.45.176.8
ns2.star.net.kp.    432000  IN  A   175.45.176.9
star-co.net.kp.     432000  IN  NS  ns1.star-co.net.kp.
star-co.net.kp.     432000  IN  NS  ns2.star-co.net.kp.
ns1.star-co.net.kp. 432000  IN  A   175.45.176.8
ns2.star-co.net.kp. 432000  IN  A   175.45.176.9
star-di.net.kp.     432000  IN  NS  ns1.star-di.net.kp.
star-di.net.kp.     432000  IN  NS  ns2.star-di.net.kp.
ns1.star-di.net.kp. 432000  IN  A   175.45.176.8
ns2.star-di.net.kp. 432000  IN  A   175.45.176.9
net.kp.         432000  IN  SOA ns1.net.kp. root.net.kp. 2013082901 28800 86400 1209600 86400
;; Query time: 409 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:30:04 2016
;; XFR size: 30 records (messages 1, bytes 618)

org.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR org.kp. @ns2.kptc.kp
;; global options: +cmd
org.kp.         432000  IN  SOA ns1.org.kp. root.org.kp. 2013082900 28800 86400 1209600 86400
org.kp.         432000  IN  NS  ns1.org.kp.
org.kp.         432000  IN  NS  ns2.org.kp.
cooks.org.kp.       432000  IN  NS  ns1.cooks.org.kp.
cooks.org.kp.       432000  IN  NS  ns2.cooks.org.kp.
ns1.cooks.org.kp.   432000  IN  A   175.45.176.8
ns2.cooks.org.kp.   432000  IN  A   175.45.176.9
kass.org.kp.        432000  IN  NS  ns1.kass.org.kp.
kass.org.kp.        432000  IN  NS  ns2.kass.org.kp.
ns1.kass.org.kp.    432000  IN  A   175.45.176.8
ns2.kass.org.kp.    432000  IN  A   175.45.176.9
koredufund.org.kp.  432000  IN  NS  ns1.koredufund.org.kp.
koredufund.org.kp.  432000  IN  NS  ns2.koredufund.org.kp.
ns1.koredufund.org.kp.  432000  IN  A   175.45.176.8
ns2.koredufund.org.kp.  432000  IN  A   175.45.176.9
korelcfund.org.kp.  432000  IN  NS  ns1.korelcfund.org.kp.
korelcfund.org.kp.  432000  IN  NS  ns2.korelcfund.org.kp.
ns1.korelcfund.org.kp.  432000  IN  A   175.45.176.8
ns2.korelcfund.org.kp.  432000  IN  A   175.45.176.9
ns1.org.kp.     432000  IN  A   175.45.176.15
ns2.org.kp.     432000  IN  A   175.45.176.16
sdprk.org.kp.       432000  IN  NS  ns1.sdprk.org.kp.
sdprk.org.kp.       432000  IN  NS  ns2.sdprk.org.kp.
ns1.sdprk.org.kp.   432000  IN  A   175.45.176.8
ns2.sdprk.org.kp.   432000  IN  A   175.45.176.9
org.kp.         432000  IN  SOA ns1.org.kp. root.org.kp. 2013082900 28800 86400 1209600 86400
;; Query time: 409 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:30:24 2016
;; XFR size: 26 records (messages 1, bytes 548)

rep.kp Zone File Data

; <<>> DiG 9.8.3-P1 <<>> AXFR rep.kp. @ns2.kptc.kp
;; global options: +cmd
rep.kp.         432000  IN  SOA ns1.rep.kp. root.rep.kp. 2013082900 28800 86400 1209600 86400
rep.kp.         432000  IN  NS  ns1.rep.kp.
rep.kp.         432000  IN  NS  ns2.rep.kp.
gnu.rep.kp.     432000  IN  NS  ns1.gnu.rep.kp.
gnu.rep.kp.     432000  IN  NS  ns2.gnu.rep.kp.
ns1.gnu.rep.kp.     432000  IN  A   175.45.176.8
ns2.gnu.rep.kp.     432000  IN  A   175.45.176.9
ns1.rep.kp.     432000  IN  A   175.45.176.15
ns2.rep.kp.     432000  IN  A   175.45.176.16
rodong.rep.kp.      432000  IN  NS  ns1.rodong.rep.kp.
rodong.rep.kp.      432000  IN  NS  ns2.rodong.rep.kp.
ns1.rodong.rep.kp.  432000  IN  A   175.45.176.8
ns2.rodong.rep.kp.  432000  IN  A   175.45.176.9
vok.rep.kp.     432000  IN  NS  ns1.vok.rep.kp.
vok.rep.kp.     432000  IN  NS  ns2.vok.rep.kp.
ns1.vok.rep.kp.     432000  IN  A   175.45.176.8
ns2.vok.rep.kp.     432000  IN  A   175.45.176.9
rep.kp.         432000  IN  SOA ns1.rep.kp. root.rep.kp. 2013082900 28800 86400 1209600 86400
;; Query time: 410 msec
;; SERVER: 175.45.176.16#53(175.45.176.16)
;; WHEN: Mon Sep 19 22:30:37 2016
;; XFR size: 18 records (messages 1, bytes 388)

About

Snapshot of North Korea's DNS data taken from zone transfers.

Resources

Readme
Activity

Stars

1.7k stars

Watchers

94 watching

Forks

212 forks
Report repository

Releases

No releases published

Packages

No packages published

Contributors 3

  •  
  •  
  •