CS - DNS Enumeration

---

host {{domain}}

host -t {{record}} {{domain}}

Replace {{record}} with DNS records - A , AAAA , NS , TXT , MX , PTR , CNAME

For MX record

Note

The lower the priority number the first it will be to forward mail address

one liner for subdomain enumeration

for subdomain in $(cat {{wordlist.txt}}); do host $subdomain.{{domain}}; done

Replace {{wordlist.txt}} with a file populated with popular subdomains, such as /usr/share/worldlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt and {{domain}} with domain name.

DNS scan on the main record types for subdomain enumeration

dnsrecon -d {{domain}} -t std

subdomain brute forcing

dnsrecon -d {{domain}} -D {{wordlist.txt}} -t brt

Replace {{wordlist.txt}} with a file populated with popular subdomains, such as /usr/share/worldlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt and {{domain}} with domain name.

automated DNS enumeration

dnsenum {{domain}}