# Port 53 - DNS

Nmap:

`nmap --script=dns-zone-transfer -p 53 ns2.megacorpone.com`

&#x20;

**Dig:**

```
dig any domain.name $IP
```

```
dig axfr domain.name $IP
```

nslookup

**Forward Lookup Brute Force**

```bash
for ip in $(cat /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt); do host $ip.megacorpone.com; done | grep -v "not found"
```

**Reverse Lookup Brute Force**

(Useful if a range was found and it's possible there are hostnames within that range that are not on your wordlist from the forward lookup)

```bash
for ip in $(seq  50 240); do host 51.222.169.$ip; done | grep -v "not found"
```

**DNS Zone Transfer:**

(This makes a copy of the DNS file and should never be allowed, so it represents a severe misconfiguration)

`host -l megacorpone.com ns2.megacorpone.com` &#x20;
