Foot Printing and Reconnaisance
Directory Enumeration - Finding Directories in a Website
Using Gobuster
Using ffuf
File Enumeration - Finding Specific files in a Website
Using Gobuster
Using ffuf
VHOST Enumeration - Finding Subdomains of a Website
Using Gobuster
Using ffuf
Digital Certificates
We can find subdomains from certificates issued to the main domain as sometimes they all use the same certificate.
Digital Certificates Search Engines
DNS Enumeration
Automated Tools
dnsrecon -d zonetransfer.me -t axfr
dnsenum zonetransfer.me
fierce --domain zonetransfer.me
Linux
dig <ip/domain>
- Normal / DNS lookupdig ns zonetransfer.me
- Name Serverdig mx zonetransfer.me
- Mail Serverdig cname zonetransfer.me
- cname recordhost zonetransfer.me
- Normal / DNS lookuphost -t ns zonetransfer.me
- Name Serverhost -t mx zonetransfer.me
- Mail Serverhost -t cname zontransfer.me
- cname recordhost <IP>
- Reverse Lookup
Windows
nslookup zonetransfer.me
Just type
nslookup
to enter interactive mode in windows.Then type
set type=ns
, press enter [ type = ns, txt, …. ]Next type
zonetransfer.me
, press enter
Zone Transfer
Finding Name Servers
First find the name servers using any one of the following commands:
host -t ns zonetransfer.me
dig ns zonetransfer.me
Then Check each name server for zone transfer using the following commands:
Using host
Using dig
Using nslookup
Last updated