DNS:
Enumeration
DNS records, zone transfers, subdomains, and misconfig probing guides
DNS Zone Transfer (AXFR)
Exploit misconfigured DNS servers to perform AXFR zone transfers, extracting complete DNS records to map target infrastructure and discover hidden subdomains.
Reverse DNS Lookup Sweeps
Perform reverse DNS lookup sweeps to map IP ranges to hostnames, uncover hidden infrastructure, and identify targets during network enumeration.
Subdomain Brute Forcing
Systematically discover hidden subdomains by automating DNS queries against wordlists, revealing exposed infrastructure and expanding attack surface visibility.
DNS enumeration extracts hostnames, IP mappings, and infrastructure details through direct interaction with DNS servers. Zone transfers, subdomain brute-forcing, and targeted record queries are the core techniques.
AXFR zone transfers dump the entire zone file when misconfigured, revealing all records in a single request. When zone transfers are denied, subdomain brute-forcing with wordlists and tools like gobuster, dnsenum, or fierce discovers hosts incrementally. Reverse lookups on discovered IP ranges fill in additional hostnames. Querying specific record types (MX, SRV, TXT, CNAME) exposes mail servers, service endpoints, SPF/DKIM configurations, and cloud provider aliases.