srl
DNS
DNS translates domain names to IP addresses and is the foundation of every other enumeration path — subdomain discovery feeds HTTP probing, zone transfers expose the entire internal namespace, and misconfigured records enable takeover and cache poisoning. It typically runs on port 53 UDP, with TCP/53 used for large responses, DNSSEC, and zone transfers.
2025–2026 context: zone transfers are thirty years old and still misconfigured in 18% of enterprise DNS setups, and a 2022 survey found 12% of organisations had at least one nameserver allowing unauthorised AXFR. At the same time, DNS rebinding has become a first-class vulnerability class — Microsoft Playwright MCP Server (CVE-2025-9611), Glances (CVE-2026-32632), Rojo (RUSTSEC-2026-0279), and multiple Rust MCP servers were all rebindable in 2026. Cache poisoning returned with BIND 9 CVE-2025-40778 (CVSS 8.6) and the weak-PRNG CVE-2025-40780.