Reverse lookup#
dig -p 53 -x $IP @$IP
Attempt zone transfer#
dig @$IP -t AXFR domain.local
Run standard dnsrecon#
dnsrecon -d domain.local -t std -n $IP
Brute force subdomains#
dnsrecon -d domain.local -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt -n $IP
Query specific record types#
dig @$IP domain.local A
dig @$IP domain.local MX
dig @$IP _ldap._tcp.dc._msdcs.domain.local SRV