Active vs Passive Recon
|
Key Difference: Passive recon = you never touch the target’s systems. Active recon = you interact directly with the target (ping, port scan, DNS query). Active recon may trigger IDS/firewall alerts, so always document your scope. |
Â
DNS Enumeration Techniques
- Zone Transfer (AXFR) — Attempts to copy all DNS records from a nameserver
- Subdomain Brute Force — Guessing subdomains using a wordlist
- Reverse DNS Lookup — Finding hostnames from IP addresses
- DNSSEC Enumeration — Extracting zone data from DNSSEC-enabled domains
DNS Enumeration Commands
|
Command |
Purpose |
|
nslookup -type=MX target.com |
Find mail server records |
|
dig target.com ANY |
Query all available DNS record types |
|
dig axfr @ns1.target.com target.com |
Attempt DNS zone transfer |
|
fierce –domain target.com |
Subdomain brute force (Kali tool) |
|
dnsrecon -d target.com |
Comprehensive DNS reconnaissance |
Â
Nmap for Host Discovery
- nmap -sn 192.168.1.0/24 — Ping sweep to find live hosts
- nmap -sV -p 1-1000 <target> — Version detection on top 1000 ports
- nmap -O <target> — OS fingerprinting (requires root)
- nmap –script=vuln <target> — Run vulnerability detection scripts