> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/dns/active-dns-enumeration.md).

# Active DNS Enumeration

### **Zone Transfer Attack**

Zone transfer (`AXFR`) is a method used to replicate DNS records between primary and secondary name servers. If misconfigured, it allows an attacker to retrieve all DNS records of a domain.

* **Find the Name Servers (NS) of the Domain**

```bash
dig NS example.com    
host -t ns example.com
nslookup -type=ns example.com
```

* **Find the Master DNS Name Server (SOA Record)**

```bash
dig SOA example.com
host -t soa example.com
nslookup -type=soa example.com
```

* The **Start of Authority (SOA) record** contains information about the primary name server.
* **Check for AXFR (Zone Transfer)**

If the DNS server allows zone transfers, an attacker can dump all records.

**Using `host` command**

```bash
host -t axfr example.com <master-DNS-NS-name>
```

Example:

```bash
host -t axfr zonetransfer.me nsztm1.digi.ninja
```

**Using `nslookup` command**

```bash
nslookup -type=axfr example.com <master-DNS-NS-name>
```

Example:

```bash
nslookup -type=axfr zonetransfer.me nsztm1.digi.ninja
```

**Using `dig` command**

```bash
dig -t axfr example.com @<master-DNS-NS-name>
```

Example:

```bash
dig zonetransfer.me axfr @nsztm1.digi.ninja
```

* If the zone transfer is successful, it will return a full list of subdomains, mail servers, and other DNS records.

***

### **Subdomain Bruteforcing**

Subdomain brute-forcing helps find hidden subdomains by guessing possible names using a wordlist.

#### **Requirements for Brute Force**

1. **Wordlist** – A list of common subdomains (e.g., `www`, `admin`, `mail`, `vpn`).
2. **Resolver List** – A list of public DNS servers to resolve subdomains.

#### **Popular Resolver Lists**

* [Trickest Public Resolvers](https://trickest.com/)
* [Public-DNS](https://public-dns.info/)
* [SecLists DNS Resolvers](https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS)

#### **DNS Resolver Validation**

Before running a brute-force attack, validate resolvers to ensure they work correctly.

```bash
dnsvalidater -tL list-of-resolver -threads 5
```

#### **Subdomain** Generate

Using `mksub`:

```bash
mksub -d example.com -w subdomains_wordlist.txt -o example_wordlist.txt
```

**Tools**

* dnsx
* dnsenum
* knockpy
* sublister