adidnsdump
Dumps the DNS records integrated into Active Directory.
When DNS is Active Directory-integrated (the norm in a Windows domain), any authenticated user can read the zone over LDAP, including records that do not resolve by direct query because they are not *enumerable*. adidnsdump pulls them all: internal hostnames, servers, services. It is the way to turn "I have credentials" into "I have the internal network's name map" without relying on a classic zone transfer, which is rarely open.
Family Active Directory enumeration
Flags -u -p -r --dns-tcp
Concepts LDAP Enumeration, DNS zone transfer (AXFR)
Cheatsheet Enumeration
Installation
pipx install adidnsdumpUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.