skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-dns

Tests DNS services for zone transfers, open recursion, and enumeration weaknesses during authorized engagements.

954|172|Updated Mar 13, 2026
Search Tags:#dns#penetration-testing#network-security#subdomain-enumeration#dig#zone-transfer#dnsrecon
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-dns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-dns
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-dns
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-dns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DNS servers often leak entire zone data, internal hostnames, and Active Directory topology through misconfigurations that manual testing easily misses. This Skill provides a structured methodology to enumerate and verify DNS weaknesses so findings are confirmed with evidence rather than guesswork.

Core Features & Use Cases

  • Zone Transfer (AXFR) Testing: Attempts full zone transfers with dig, fierce, and dnsrecon to dump every host record when allow-transfer is misconfigured.
  • Enumeration & Fingerprinting: Extracts version banners via version.bind CHAOS queries, runs nmap dns-* NSE scripts, and brute-forces subdomains and reverse ranges.
  • AD & Misconfiguration Discovery: Queries SRV records (_ldap, _kerberos, _gc) to locate domain controllers, checks open recursion via the ra flag, and audits DNSSEC/NSEC and CAA policies.
  • Use Case: During an authorized internal pentest, run the AXFR checks against a client's DNS server at 10.0.0.5; if the transfer succeeds, you instantly map every internal hostname and IP for follow-on attacks.

Quick Start

Ask the AI to test the DNS server at a given IP address for zone transfer vulnerabilities, open recursion, and subdomain enumeration using this skill.

Frequently Asked Questions about pentesting-dns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a DNS server for zone transfer vulnerabilities?▼

Run dig axfr @<DNS_IP> <DOMAIN> to attempt a full zone transfer. A successful transfer returns multiple records ending with an SOA record instead of 'Transfer failed'. Tools like fierce and dnsrecon -a automate AXFR attempts against every nameserver.

How to enumerate subdomains with DNS tools?▼

Use dnsrecon or dnsenum with a wordlist against the target nameserver, e.g. dnsrecon -D subdomains.txt -d <DOMAIN> -n <DNS_IP>. For IPv6, dnsdict6 brute-forces AAAA records, and reverse sweeps use dnsrecon -r <range>.

What tools are best for DNS penetration testing?▼

dig handles all record queries, AXFR, and version.bind checks. dnsrecon and dnsenum cover transfers and brute forcing, fierce targets every NS, and nmap dns-* NSE scripts handle NSID, SRV enumeration, and NSEC walking.

How do I check if a DNS server allows open recursion?▼

Query an external domain with dig google.com A @<DNS_IP> and inspect the response flags. If the 'ra' (recursion available) flag is present, recursion is enabled and the server can be abused for amplification attacks.

Can DNS enumeration reveal Active Directory domain controllers?▼

Yes. Querying SRV records such as _ldap._tcp, _kerberos._tcp, and _gc._tcp returns the FQDNs and ports of domain controllers. The nmap dns-srv-enum script automates this discovery against a target domain.

Why does a DNS zone transfer fail even when the server is reachable?▼

Transfers fail when allow-transfer is restricted to authorized secondary nameservers or when TCP port 53 is filtered. In that case, fall back to subdomain brute forcing, reverse-DNS sweeps, and NSEC walking for DNSSEC-signed zones.

Related Skills

Explore More Software Engineering Skills→
starwreckntxstarwreckntx

Reconnaissance Agent

Perform network reconnaissance to map topology and enumerate ports and services.

Community
Basic
woohyun212woohyun212
21

ad-pentest

Perform six-phase Active Directory penetration testing with BloodHound and ADCS enumeration.

Community
Advanced
Ap6packAp6pack
4

recon-asset-discovery

Map authorized external attack surfaces by discovering domains, subdomains, IPs, and DNS signals.

Community
Advanced
GratefulJinx77GratefulJinx77

Recon

Perform passive and active network reconnaissance using WHOIS, DNS, and OSINT.

Community
Advanced