> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-udp-dns-53.md).

# TCP/UDP: DNS - 53

## Basic

### NsLookup

> Follow the steps:
>
> ```bash
> nslookup
> ```
>
> ```bash
> SERVER <Target DNS IP Address>
> ```
>
> ```
> <IP to resolve>
> ```

### Dig

```bash
dig @<Target DNS IP Address> any <Domain Name to resolve>
```

```bash
dig axfr <Domain Name to resolve> @<Target DNS IP Address>
```

### Host

```bash
host <Domain Name to resolve>
```

```bash
host -t mx <Domain Name to resolve>
```

```bash
host -t txt <Domain Name to resolve>
```

## Additional

### Nmap

{% code overflow="wrap" %}

```bash
nmap -n --script "(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport" <Target IP Address>
```

{% endcode %}

```bash
nmap --script=dns-zone-transfer -p 53 <Domain Name>
```

### DNSRecon

Perform standard scan on the domain name

```bash
dnsrecon -d <Domain Name> -t std
```

Perform DNS Enumeration

```bash
dnsrecon -d <Domain Name> -n <Target DNS IP Address>
```

```bash
dnsenum <Domain Name>
```