DNS

DNS translates domain names to IP addresses and is the foundation of every other enumeration path — subdomain discovery feeds HTTP probing, zone transfers expose the entire internal namespace, and misconfigured records enable takeover and cache poisoning. It typically runs on port 53 UDP, with TCP/53 used for large responses, DNSSEC, and zone transfers.

2025–2026 context: zone transfers are thirty years old and still misconfigured in 18% of enterprise DNS setups, and a 2022 survey found 12% of organisations had at least one nameserver allowing unauthorised AXFR. At the same time, DNS rebinding has become a first-class vulnerability class — Microsoft Playwright MCP Server (CVE-2025-9611), Glances (CVE-2026-32632), Rojo (RUSTSEC-2026-0279), and multiple Rust MCP servers were all rebindable in 2026. Cache poisoning returned with BIND 9 CVE-2025-40778 (CVSS 8.6) and the weak-PRNG CVE-2025-40780.

Useful resources:

• HackTricks — Pentesting DNS
• HackTricks — 53 Pentesting DNS (2026) — includes DNSSEC auditing and recursion DDoS

1. DNS Records

2. Basic Interaction

AD service records:

dig -t _gc._tcp.lab.domain.com
dig -t _ldap._tcp.lab.domain.com
dig -t _kerberos._tcp.lab.domain.com
nmap --script dns-srv-enum --script-args "dns-srv-enum.domain='domain.com'"

3. Zone Transfer (AXFR)

A successful AXFR returns the complete host inventory of a domain — internal servers, naming conventions, subdomains, and infrastructure names that reveal function (vpn, dc01, backup).

3.1 Manual

# Without specifying a domain
dig axfr @<DNS_IP>

# With a domain
dig axfr @<DNS_IP> <DOMAIN>

# fierce
fierce --domain <DOMAIN> --dns-servers <DNS_IP>

# host
host -l <DOMAIN> <DNS_IP>

3.2 Automated — the 2026 tools

# dnsrecon — full enumeration including AXFR
dnsrecon -d <domain.tld> -n <dns-ip> -t std,axfr

# lupaxa
lupaxa-zone-transfer --domain <domain.tld>

Zone transfer returns the entire namespace in one request — it is the highest-value DNS finding, and the fix is a single allow-transfer directive in BIND.

4. Subdomain Enumeration

4.1 Passive sources

4.2 Active brute force — modern resolver stack

The 2026 pipeline replaces naive for loops with wildcard-aware mass resolvers.

puredns:

# Brute force
puredns bruteforce wordlist.txt example.com --resolvers resolvers.txt

# Brute force multiple domains
puredns bruteforce all.txt -d domains.txt

# Resolve an existing list (dedupe + wildcard filter)
puredns resolve candidates.txt --resolvers resolvers.txt

# Pipe from stdin
cat wordlist.txt | puredns bruteforce domain.com

dnsx:

# Resolve a host list, show the answer
dnsx -l hosts.txt -resp -a

# Brute force with a wordlist, filter wildcards
dnsx -d example.com -w wordlist.txt -a -cname -wildcard-domain example.com

# Query every record type in one pass
dnsx -l hosts.txt -recon -json

# Enrich with ASN / CDN
dnsx -l hosts.txt -asn -cdn

shuffledns:

shuffledns -d example.com -w wordlist.txt -r resolvers.txt

Wildcard filtering is the difference between a usable list and 40,000 garbage hits. A wildcard *.example.com makes every random name resolve; puredns and dnsx detect the pattern and strip it.

4.3 Subdomain fuzzing (HTTP-layer)

ffuf -w wordlist.txt:FUZZ -u https://FUZZ.server.com/
gobuster dns -d example.com -w wordlists.txt

4.4 VHost fuzzing — one IP, many sites

ffuf -w wordlist.txt:FUZZ -u http://academy.htb:PORT/ \
  -H 'Host: FUZZ.academy.htb' -fs <baseline-size>

gobuster vhost --url test.example \
  --wordlist /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --append-domain

4.5 Reverse DNS and reverse brute force

# Reverse lookup
dig -x 192.168.0.2 @<dns-ip>

# Reverse brute force a subnet
dnsrecon -r 127.0.0.0/24 -n <dns-ip>
dnsrecon -r <dns-ip>/24 -n <dns-ip>
dnsrecon -d active.htb -a -n <dns-ip>

If subdomains resolve to internal IPs, reverse DNS brute-force the entire range — it uncovers hosts that have no forward record and therefore never appear in brute-force results.

4.6 DNSSEC NSEC walking

nmap -sSU -p53 --script dns-nsec-enum --script dns-nsec3-enum <ip> enumerates zones that use NSEC/NSEC3, revealing names the zone did not intend to disclose.

5. Modern DNS Reconnaissance (2025–2026)

5.1 enumdns — modular recon

enumdns resolves hosts from wordlists, BloodHound files, and Active Directory environments, and adds threat analysis with eight detection techniques — typosquatting, bitsquatting, homographic attacks, and malicious-domain detection.

enumdns recon -d test.com -o enumdns.txt
enumdns brute -d test.com -w /tmp/wordlist.txt -o enumdns.txt
enumdns resolve bloodhound -L /tmp/bloodhound_computers.json -o enumdns.txt
enumdns threat-analysis -d example.com --all-techniques -o threats.txt

Features worth knowing: auto-identification of cloud provider services, multi-record retrieval (CNAME/A/AAAA), SOA linking per zone, AD domain controller enumeration, and SOCKS4/SOCKS5 proxy support.

5.2 trident — keyless OSINT

A single binary with no API keys, no registration, no configuration — DNS lookups, ASN info, certificate transparency, threat intelligence, and PGP key search.

5.3 DNS-based OSINT via TXT records

Large-scale TXT record analysis uncovers hidden services and technology dependencies. The technique identified the Drift service across infrastructure in the August–September 2025 Salesloft breach.

dig txt <domain> +short | grep -i "verify\|site\|domain"

6. DNS Rebinding (2025–2026)

A DNS rebinding attack exploits the gap between the DNS resolution used for validation and the resolution used for the actual fetch. The attacker’s domain first resolves to a public IP (passing any allowlist), then re-resolves to 127.0.0.1 or an internal address after the TTL expires.

6.1 The 2026 rebinding CVEs

6.2 Testing

Precondition: the target validates the hostname but not the resolved IP at request time — the classic TOCTOU.

# Public rebinding service
# https://lock.cmpxchg8b.com/rebinder.html

# Or host your own with a 1-second TTL alternating between
# a public IP and 127.0.0.1

The fix is DNS pinning — resolve once, then use CURLOPT_RESOLVE (or the language equivalent) to force the same IP for the fetch. Validating the hostname without pinning the IP is not a defence.

7. Subdomain Takeover

A subdomain takeover occurs when a DNS record points to a service the organisation no longer controls — an unclaimed Heroku app, a deleted GitHub Pages repo, an expired S3 bucket.

7.1 Detection

# Nuclei — fastest and most comprehensive
nuclei -l all_subs_resolved.txt -t takeovers/ -o takeovers.txt

# subjack
./subjack -w all_subs_resolved.txt -t 100 -timeout 30 -o subjack.txt -ssl

# sub404
python3 sub404.py -f all_subs_resolved.txt

# Manual — check the CNAME, then visit the target
dig CNAME dev.target.com

7.2 Fingerprints

7.3 The 2026 refinement — dangling cloud IPs

A record pointing directly to a reusable cloud IP is a takeover primitive even without a CNAME. The attacker obtains the same IP, and can then obtain trusted TLS certificates for the hostname and serve attacker-controlled content from it.

CVE-2026-54588 (Poweradmin) chains host-header injection to subdomain takeover and ACME DNS-01 abuse — the takeover is not the end goal, it is the primitive that enables wildcard certificate issuance.

8. DNS Cache Poisoning (2025–2026)

Kaminsky-style attack precondition: the resolver accepts unsolicited RRs for a name it did not query, or uses a predictable transaction ID / source port.

# Check the transaction-ID randomness and source-port randomness
nmap -n --script dns-random-txid <ip>
nmap -n --script dns-random-srcport <ip>

9. DNS Tunneling and Exfiltration

DNS is frequently the only egress protocol allowed, which makes it the channel of choice for data exfiltration and C2.

9.1 Detection signals

9.2 Defensive tooling

TunTight is the first in-path per-query DNS tunneling prevention system — it detected 349 confirmed tunnels at the very first query with negligible false positives or negatives.

10. Notable DNS CVEs (2025–2026)

11. Testing Methodology

1. Banner and version
   - dig version.bind CHAOS TXT @<dns>
   - nmap --script dns-nsid

2. Zone transfer
   - dig axfr @<dns> <domain>
   - dnsrecon -d <domain> -n <dns> -t axfr
   - lupaxa-zone-transfer --domain <domain>

3. Subdomain enumeration
   - Passive: subfinder, crt.sh, assetfinder
   - Active: puredns bruteforce / dnsx -d -w / shuffledns
   - VHost: ffuf -H "Host: FUZZ.<domain>"
   - Reverse: dnsrecon -r <cidr>

4. DNSSEC walking
   - nmap --script dns-nsec-enum,dns-nsec3-enum

5. Takeover
   - nuclei -t takeovers/
   - Check CNAMEs and dangling A records to cloud IPs

6. Rebinding
   - Does the target validate resolved IP or only hostname?
   - Test with a 1-second TTL rebinding domain

7. Cache poisoning
   - nmap --script dns-random-txid,dns-random-srcport
   - Check whether unsolicited RRs are accepted

8. AD service records
   - dig -t _gc._tcp / _ldap._tcp / _kerberos._tcp

12. Hardening

13. Field Notes

• Zone transfers are still the highest-value DNS finding. 18% of enterprise setups remain misconfigured, and one AXFR returns the entire internal namespace.
• Wildcard filtering is what makes brute force usable. puredns and dnsx strip wildcard noise; a raw for loop does not.
• Reverse DNS brute force finds hosts that forward brute force cannot. If subdomains resolve internally, sweep the IP range.
• DNS rebinding is a 2026 growth area. Playwright MCP, Glances, Rojo, and multiple Rust MCP servers were all rebindable — the common failure is validating the hostname without pinning the IP.
• Dangling A records to cloud IPs are takeovers too — not just CNAMEs, and they enable trusted TLS certificate issuance.
• Poweradmin CVE-2026-54588 chains host-header injection → subdomain takeover → ACME DNS-01 — takeover as a primitive, not an end goal.
• BIND cache poisoning returned in 2025. CVE-2025-40778 (CVSS 8.6) and the weak-PRNG CVE-2025-40780 are the current resolver patches.
• DNS is the egress channel of choice. Long high-entropy labels, TXT/NULL volume, and non-native tooling are the detection signals — TunTight catches 349 tunnels at the first query.
• 81.6% of top domains lack DMARC, and only 3.9% enforce reject — email spoofing is still largely open.
• enumdns bridges DNS recon and AD — it resolves hosts from BloodHound files and enumerates domain controllers directly.