dns.cheat

% DNS Enum

$ options: echo "a|txt|ns|mx|axfr" | tr '|' '\n'
$ target: if [[ ! -z $target ]]; then; echo $target; fi
$ wordlist: fdfind . /usr/share/{seclists,wordlists} /usr/share/amass/ -Ltf | grep -i dns | sort -u 


# whois on the target
whois <target>

# dig on the target
dig <options> <target>

# dig on the target with nameserver
dig <options> <target> @ns1.<target>


# use host to query the dns
host -t <options> <target> | tee -a 

# list all options?
host -a <target>
# host with nameserver (i think reverse dns lookup)
host -l <target> <nameserver>.<target>

# zonetransfer on nameserver (ns1.. etc)
dnsrecon -d <target> -t axfr @<nameserver>.<target>

# dnsenum the target
dnsenum <target>

# nslookup with server and ns to lookup
printf "set type=any\n<reverse-lookup-ip>\nexit\n" | nslookup

# Use something decent please on your attacker box, you could use this script on a target
for sub in $(cat <wordlist>);do host $sub.<target>|grep "has.address";done

# gobuster basic 
gobuster -t 15 dns --domain <domain> --wordlist <wordlist> --show-ips

# gobuster with resolver
gobuster -t 15 dns --resolver <resolver> --domain <domain> --wordlist <wordlist> --show-ips

# enum with msfconsole basic settings (lets dos yourself with scanning)
msfconsole -q -x 'use auxiliary/gather/enum_dns;set DOMAIN <domain>; set WORDLIST <wordlist>;options'