Tools

• dig

dig @1.1.1.1 domain.com MX
dig domain.com any
# ask DNS zone info

• whois

whois domain.com
#info registrar / owner of domain name

nslookup domain.com
nslookup -type=ANY tryhackme.com 1.1.1.1
# similar to dig
nslookup
> set type=ANY
> domain.name

• https://dnsdumpster.com/ (énumération des sous domaines + graph )
• https://asnlookup.com (search ASN )
• https://www.shodan.io/ (ASN,IOT …)
• https://crt.sh/ (Certificate Transparency logs)

amass

amass enum -d example.com

amass/doc/user_guide.md at master · owasp-amass/amass

dnsrecon

dnsrecon -n dnsserver -d example.com

sublist3r

(domain enumeration via search engine)

sublist3r -d example.com

dnsenum

(brute force enumeration + transfert de zone )