dnsrecon

DNS enumeration by record type, AXFR and reverse sweeps.

Python DNS enumerator with the fine control dnsenum lacks: you pick exactly which check to run (`std` for normal records, `axfr` for the zone transfer, `brt` for brute force, `srv` for service records, which in an Active Directory domain give away the domain controllers). `SRV` records are its most profitable use in AD: `_ldap._tcp.dc._msdcs.<domain>` points straight at the DC.

Family Recon, DNS & OSINT

Flags -d -t axfr -t brt -D -r

Concepts DNS zone transfer (AXFR)

Cheatsheet DNS · 53

Installation

sudo apt install -y dnsrecon

Useful commands3 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.