> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# adidnsdump

> adidnsdump: enumerate DNS records from Active Directory via LDAP to discover internal hosts.

## Install

```bash theme={"dark"}
pip install adidnsdump
```

***

## Usage

```bash theme={"dark"}
adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP
adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP -r    # Resolve unknown records
```

***

## Include Tombstoned Records

```bash theme={"dark"}
adidnsdump -u 'DOMAIN\user' -p 'password' DC_IP --include-tombstoned
```

***

## Output

Creates `records.csv` with all DNS records from AD-integrated DNS zones.

```bash theme={"dark"}
cat records.csv
```

Columns: `type, name, value` (three columns; the CSV header is literally `type,name,value`). There is no `zone` column.

***

## With LDAP (Manual)

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=local" -D "user@domain.local" -w 'pass'
```

***

## Why Use It

* Discover internal hosts not in ping sweep
* Find hidden services, dev servers, legacy systems
* Map internal infrastructure via DNS
* Works with any domain user (low privilege)

***

## Quick Reference

| Task       | Command                                    |
| ---------- | ------------------------------------------ |
| Dump DNS   | `adidnsdump -u 'DOM\user' -p 'pass' DC_IP` |
| Resolve    | Add `-r` flag                              |
| Tombstoned | Add `--include-tombstoned`                 |
| Output     | `records.csv`                              |