Active vs Passive Recon

Key Difference: Passive recon = you never touch the target’s systems. Active recon = you interact directly with the target (ping, port scan, DNS query). Active recon may trigger IDS/firewall alerts, so always document your scope.

 

DNS Enumeration Techniques

  • Zone Transfer (AXFR) — Attempts to copy all DNS records from a nameserver
  • Subdomain Brute Force — Guessing subdomains using a wordlist
  • Reverse DNS Lookup — Finding hostnames from IP addresses
  • DNSSEC Enumeration — Extracting zone data from DNSSEC-enabled domains

DNS Enumeration Commands

Command

Purpose

nslookup -type=MX target.com

Find mail server records

dig target.com ANY

Query all available DNS record types

dig axfr @ns1.target.com target.com

Attempt DNS zone transfer

fierce –domain target.com

Subdomain brute force (Kali tool)

dnsrecon -d target.com

Comprehensive DNS reconnaissance

 

Nmap for Host Discovery

  • nmap -sn 192.168.1.0/24 — Ping sweep to find live hosts
  • nmap -sV -p 1-1000 <target> — Version detection on top 1000 ports
  • nmap -O <target> — OS fingerprinting (requires root)
  • nmap –script=vuln <target> — Run vulnerability detection scripts
PreviousNext