> For the complete documentation index, see [llms.txt](https://p0db0t.gitbook.io/pentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://p0db0t.gitbook.io/pentest/tcp/53-dns.md).

# 53 ) DNS

* DNS Reverse lookup

```bash
nslookup
SERVER IP
127.0.0.1
127.0.0.2
bank.htb
IP
```

* DNSRecon

```bash
dnsrecon -r 127.0.0.0/24 -d 10.10.10.29
dnsrecon -r 10.10.10.0/24 -d 10.10.10.29
```

* DNS Zone Transfer

```bash
dig axfr @10.10.10.29
dig axfr bank.htb @10.10.10.29
```

* Config Files

```bash
nano /etc/resolv.conf
# Then add nameserver ex : 10.10.10.29
```

* Subdomain Brute Forcing

```bash
for sub in $(cat /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.<DOMAIN> @<IP> | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done   

dnsenum --dnsserver <IP> --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/SecLists/Discovery/DNS/subdomains-top1million-110000.txt <DOMAIN>     
```