15 lines
660 B
Markdown
15 lines
660 B
Markdown
- Zone Transfer
|
||
- `dig @<server IP> ironcorp.me axfr`
|
||
- `nslookup ls -d <domain name>`
|
||
- Extract all DNS records via LDAP (requires domain user)
|
||
- `adidnsdump -u contoso\\Anakin contoso.local`
|
||
- DNSRecon
|
||
- `dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml`
|
||
- Internal Network
|
||
- `nmap --script broadcast-dhcp-discover`
|
||
- Uses DHCP Discover requests to enumerate the current domain
|
||
- Get a list of domain controllers (replace domain.local with domain name)
|
||
- `dig -t SRV _gc._tcp.domain.local`
|
||
- `dig -t SRV _ldap._tcp.domain.local`
|
||
- `dig -t SRV _kerberos._tcp.domain.local`
|
||
- `dig -t SRV _kpasswd._tcp.domain.local` |