Comment on page
DNS
nmap -sC -sV -p53 $ip/24
nslookup $ip
dig axfr cronos.htb @10.10.10.13
host -t ns $ip
host -t txt $ip
fierce -dns $domain
host -t mx $ip
for ip in $(cat list.txt); do host $ip.website.com; done
for ip in $(seq 155 190);do host 50.7.67.$ip;done |grep -v "not found"
The ip is based on subdomain bruteforcing result
host -l $ip ns1.$ip
host -l $ip ns2.$ip
#!/bin/bash
# Simple Zone Transfer Bash Script
# $1 is the first argument given after the bash script
# Check if argument was given, if not, print usage
if [ -z "$1" ]; then
echo "[*] Simple Zone transfer script"
echo "[*] Usage : $0 <domain name> "
exit 0
fi
# if argument was given, identify the DNS servers for the domain
for server in $(host -t ns $1 | cut -d " " -f4); do
# For each of these servers, attempt a zone transfer
host -l $1 $server |grep "has address"
done
Bash script for zone transfer
dnsrecon -d $ip -t axfr
dnsrecon -d $ip -D ~/list.txt -t brt
host -t ns $ip| cut -d " " -f 4
dnsenum $ip
nmap $ip --script=dns-zone-transfer -p 53
whois $ip
host -t ns $ip
python theHarvester.py -l 500 -b all -d $ip
nmap -p 80 --script dns-brute.nse domain.com
python dnscan.py -d domain.com -w ./subdomains-10000.txt
- Gather version numbers
- Searchsploit
- Default Creds
- Creds previously gathered
- Download the software
Last modified 3yr ago