first commit

Necronomicon/Enumeration/DNS.md

@@ -0,0 +1,15 @@
+- Zone Transfer
+	- `dig @<server IP> ironcorp.me axfr`
+	- `nslookup ls -d <domain name>`
+- Extract all DNS records via LDAP (requires domain user)
+	- `adidnsdump -u contoso\\Anakin contoso.local`
+- DNSRecon
+	- `dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml`
+- Internal Network
+	- `nmap --script broadcast-dhcp-discover`
+		- Uses DHCP Discover requests to enumerate the current domain
+	- Get a list of domain controllers (replace domain.local with domain name)
+		- `dig -t SRV _gc._tcp.domain.local`
+		- `dig -t SRV _ldap._tcp.domain.local`
+		- `dig -t SRV _kerberos._tcp.domain.local`
+		- `dig -t SRV _kpasswd._tcp.domain.local`