Post

DNS

  • enumeration
    1
    2
    3
    4
    5
    6
    
    # Simple whois scan
    whois $domain
    # DNS records
    dig $domain +short # A records -> DNS IP lookup
    dig $domain -t mx +short # MAIL records
    dig $domain -t ns +short # NS, CNAME
    
  • subdomains
    1
    2
    3
    
    dig avfr $domain @10.10.10.10 # Zone transfer 
    dig -t axfr $domain @$IP
    sublist3r -d $domain
    
This post is licensed under CC BY 4.0 by the author.