oscp/Necronomicon/Enumeration/DNS.md

• Zone Transfer
  • dig @<server IP> ironcorp.me axfr
  • nslookup ls -d <domain name>
• Extract all DNS records via LDAP (requires domain user)
  • adidnsdump -u contoso\\Anakin contoso.local
• DNSRecon
  • dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml
• Internal Network
  • nmap --script broadcast-dhcp-discover
    • Uses DHCP Discover requests to enumerate the current domain
  • Get a list of domain controllers (replace domain.local with domain name)
    • dig -t SRV _gc._tcp.domain.local
    • dig -t SRV _ldap._tcp.domain.local
    • dig -t SRV _kerberos._tcp.domain.local
    • dig -t SRV _kpasswd._tcp.domain.local