diff --git a/Enumeration/Websites.md b/Enumeration/Websites.md
index 7679d32..0d175ef 100644
--- a/Enumeration/Websites.md
+++ b/Enumeration/Websites.md
@@ -40,6 +40,7 @@ seq 0 255 | fuff -u 'http://<IP>/sqli-labs/Less-1/?id=FUZZ -c -w - -fw 33
 ```sh
 ffuf -u http://<IP>/sqli-labs/Less-11/ -c -w /usr/share/seclists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded'
 ```
+
 #### Fuzz Users and use Bruteforce
 
 * Fuzz users and write file
@@ -97,6 +98,7 @@ gobuster vhost -u <URL> -w <wordlist>
 ```sh
 -x
 ```
+
 * Fuzz for files and file extensions
 ```sh
 gobuster dir -u <URL> -w /usr/share/seclists/Discovery/raft-small-word-lowercase.txt -x .conf,.js
@@ -129,3 +131,9 @@ gobuster help dir
 ```sh
 wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt -X POST --hh 45 -u http://<target-IP>/api/items\?FUZZ\=test
 ```
+
+#### DNS with Wfuzz
+
+```sh
+ wfuzz -H "Host: FUZZ.example.com" --hc 302,400 -t 50 -H "User-Agent: DEDSEC" -c -z file,"/usr/share/seclists/Discovery/Web-Content/namelist.txt" http://example.com
+ ```
diff --git a/Forensics/Windows Registration.md b/Forensics/Windows Registration.md
index 95c702a..4cae42f 100644
--- a/Forensics/Windows Registration.md	
+++ b/Forensics/Windows Registration.md	
@@ -118,4 +118,10 @@
 * First time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0064`
 * Last time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0066`
 * Last removal time -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0067`
-     
+
+
+## Tools
+
+* [Eric Zimmermann's Registry Explorer](https://ericzimmerman.github.io/#!index.md)
+* hivedump
+* hivex