> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/enumeration/dns-enumeration.md).

# DNS Enumeration

{% embed url="<https://pentestlab.blog/tag/reverse-lookup/>" %}

{% embed url="<https://github.com/darkoperator/dnsrecon>" %}

Enumerating Domain Name System or DNS can help reveal a larger scope for potential attacks.&#x20;

&#x20;

```
dig cyberbotic.io +short

follow up with: 
whois <dns.io>

nslookup

SERVER victim-ip

127.0.0.1

victim-ip again
```

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FKftp69Gnc7H2xWrfCtix%2Fimage.png?alt=media\&token=3f627d77-c6e7-455f-9eff-cbafa56f3b57)

```
dig axfr cronos.htb @10.10.10.13
```

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FFZfKCoKbpHHPr3LKkKwx%2Fimage.png?alt=media\&token=0338d9ba-446b-46cf-9f20-b672d06b39a1)

We then add those subdomains to our /etc/hosts file.

### Little Cheatsheet

| **Command**                        | **Description**                                      |
| ---------------------------------- | ---------------------------------------------------- |
| `nslookup $TARGET`                 | Identify the `A` record for the target domain.       |
| `nslookup -query=A $TARGET`        | Identify the `A` record for the target domain.       |
| `dig $TARGET @<nameserver/IP>`     | Identify the `A` record for the target domain.       |
| `dig a $TARGET @<nameserver/IP>`   | Identify the `A` record for the target domain.       |
| `nslookup -query=PTR <IP>`         | Identify the `PTR` record for the target IP address. |
| `dig -x <IP> @<nameserver/IP>`     | Identify the `PTR` record for the target IP address. |
| `nslookup -query=ANY $TARGET`      | Identify `ANY` records for the target domain.        |
| `dig any $TARGET @<nameserver/IP>` | Identify `ANY` records for the target domain.        |
| `nslookup -query=TXT $TARGET`      | Identify the `TXT` records for the target domain.    |
| `dig txt $TARGET @<nameserver/IP>` | Identify the `TXT` records for the target domain.    |
| `nslookup -query=MX $TARGET`       | Identify the `MX` records for the target domain.     |
| `dig mx $TARGET @<nameserver/IP>`  | Identify the `MX` records for the target domain.     |

### Subdomain Enumeration&#x20;

{% embed url="<https://github.com/rbsec/dnscan>" %}

<https://nuclei.projectdiscovery.io/nuclei/get-started/>

### Spoofcheck

Weak email security (SPF, DMARC and DKIM) may allow us to spoof emails to appear as though they’re coming from their own domain. [Spoofcheck](https://github.com/BishopFox/spoofcheck) is a Python tool that can verify the email security of a given domain.

```
$ ./spoofcheck.py cyberbotic.io
[+] cyberbotic.io has no SPF record!
[*] No DMARC record found. Looking for organizational record
[+] No organizational DMARC record
[+] Spoofing possible for cyberbotic.io!
```