skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-dns-enumeration-and-zone-transfer

Enumerates DNS records, attempts zone transfers, and brute-forces subdomains during authorized reconnaissance.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#reconnaissance#attack surface#subdomain discovery#dnsrecon#DNS enumeration#zone transfer
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-dns-enumeration-and-zone-transfer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-dns-enumeration-and-zone-transfer
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/performing-dns-enumeration-and-zone-transfer
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-dns-enumeration-and-zone-transfer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, manually mapping a target's DNS infrastructure is slow and error-prone, and testers often miss forgotten nameservers, wildcard DNS false positives, or leaked internal hostnames. This Skill provides a structured workflow to enumerate DNS records, test zone transfers, and discover subdomains systematically.

Core Features & Use Cases

  • Zone Transfer Testing: Attempts AXFR/IXFR against every authoritative nameserver to detect servers that leak the full zone file.
  • Multi-Source Subdomain Discovery: Combines passive sources (subfinder, amass, CT logs), active brute force (gobuster, dnsenum), and reverse PTR sweeps, with wildcard detection to filter false positives.
  • DNS Security Analysis: Validates DNSSEC, SPF, DKIM, and DMARC configurations and flags internal RFC1918 IP disclosure.
  • Use Case: A consultant scoping an external web application pentest runs this workflow against example.com, finds that ns2 allows zone transfers exposing 347 records, discovers a staging subdomain with default credentials, and reports the findings in a structured report.

Quick Start

Perform DNS enumeration and zone transfer testing against example.com and report any misconfigurations, leaked internal IPs, and discovered subdomains.

Frequently Asked Questions about performing-dns-enumeration-and-zone-transfer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for DNS zone transfer vulnerabilities?▼

Attempt an AXFR query against every authoritative nameserver using dig AXFR example.com @ns1.example.com or dnsrecon -d example.com -t axfr. A successful transfer returns the SOA record plus the full record set; a refused transfer shows Transfer failed. Test all nameservers, since secondaries are often misconfigured.

What tools are best for subdomain enumeration?▼

Combine subfinder and amass for passive discovery from certificate transparency logs and DNS databases, then use gobuster or dnsenum with a 20k+ wordlist for active brute forcing. Merging and deduplicating results from all sources avoids under-reporting the attack surface.

Why does DNS brute forcing return false positive subdomains?▼

Wildcard DNS records resolve any nonexistent subdomain to an IP, making every brute-forced name appear valid. Resolve a random name like nonexistent-xyz.example.com first; if it answers, filter all results matching the wildcard IP.

Can DNS enumeration reveal internal network information?▼

Yes. Subdomains resolving to RFC1918 addresses (10.x, 172.16-31.x, 192.168.x) leak internal infrastructure, and TXT, SRV, and PTR records can expose Active Directory services, SaaS providers, and internal naming conventions.

When should I not perform DNS enumeration and zone transfer tests?▼

Only run these techniques against domains you have written authorization to test. Do not use them for DNS amplification or reflection attacks, and avoid excessive query volumes that could trigger rate limiting or disrupt the target's DNS servers.

Related Skills

Explore More Software Engineering Skills→
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic
infantesromeroadrianinfantesromeroadrian

transilience-reconnaissance

Automate domain assessment and web application mapping for security auditing.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
hoanghn61hoanghn61

subdomain-enumeration

Enumerate subdomains via certificate transparency logs and search-engine dorks.

Community
Advanced