53 - DNS

nmap -sV -sC -p 53 TARGET
nmap -sU -p 53 TARGET

dig axfr @TARGET domain.com

host -t axfr domain.com TARGET

nmap -p 53 --script dns-zone-transfer --script-args dns-zone-transfer.domain=domain.com TARGET

dig @TARGET domain.com A
host domain.com TARGET

dig @TARGET domain.com MX

dig @TARGET domain.com NS

dig @TARGET domain.com TXT

dig @TARGET domain.com ANY

dig @TARGET -x 10.10.10.5

for i in $(seq 1 254); do dig @TARGET -x 10.10.10.$i +short; done

for sub in $(cat subdomains.txt); do dig @TARGET $sub.domain.com +short; done

dnsenum --dnsserver TARGET domain.com

dnsrecon -d domain.com -n TARGET -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

gobuster dns -d domain.com -r TARGET:53 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

dig @TARGET google.com +norecurse

dig @TARGET _gc._tcp.domain.com SRV         # Global catalog
dig @TARGET _ldap._tcp.domain.com SRV       # LDAP
dig @TARGET _kerberos._tcp.domain.com SRV   # Kerberos
dig @TARGET _kpasswd._tcp.domain.com SRV    # Kerberos password