nmap - DNS

nmap --script dns-brute,dns-zone-transfer,dns-service-discovery,dns-recursion,dns-nsec-enum --script-args dns-nsec-enum.domains=certifiedhacker.com -p 53 www.certifiedhacker.com

nmap --script dns-brute --script-args dns-brute.domain=certifiedhacker.com -ON ~/enumeration_results/dns_brute_certifiedhacker.txt && nmap --script dns-zone-transfer -p 53 certifiedhacker.com -ON ~/enumeration_results/dns_zonetransfer_certifiedhacker.txt

• Explanation: This chain executes two separate Nmap scans:

The first scan performs DNS brute-forcing (dns-brute) to discover subdomains.
The second scan attempts a DNS zone transfer (dns-zone-transfer) on port 53. (Both commands save their results to separate files.)

DNS and DNSSEC Enumeration Using Nmap

DNS Enumeration

Attackers use Nmap for scanning domains and obtaining a list of subdomains, records, IP addresses, and other valuable information from the target host.

List Available Services

Run the following command to list all the available services on the target host:

nmap --script=broadcast-dns-service-discovery <Target Domain>

The above command provides a list of subdomains along with their IP addresses. If any wildcard entries are recorded, they are represented as A for IPv4 addresses and AAAA Record for IPv6 addresses.

Subdomain enumeration

Execute the following command to retrieve all the subdomains associated with the target host:

nmap -T4 -p 53 --script dns-brute <Target Domain>

Check DNS Recursion

Run the following command to check whether DNS recursion is enabled on the target server:

nmap -Pn -sU -p 53 --script=dns-recursion 192.168.1.150

DNSSEC Enumeration

DNSSEC provides security for System queries and responses. Attackers enumerate DNSSEC using dns-nsec-enum.nse or dns-nsec3-enum.nse NSE scripts to obtain information related to domains and their subdomains.

Execute the following command to retrieve the list of subdomains associated with the target domain:

nmap -sU -p 53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=eccouncil.org <target>