skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-dns-enumeration-and-zone-transfer

Enumerates DNS records, attempts zone transfers, and brute-forces subdomains during authorized reconnaissance.

4|Updated Apr 28, 2026
Search Tags:#penetration testing#reconnaissance#dns#enumeration#subdomain#zone transfer#dnspython
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-dns-enumeration-and-zone-transfer-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-dns-enumeration-and-zone-transfer
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-dns-enumeration-and-zone-transfer
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-dns-enumeration-and-zone-transfer-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dnspython, and includes scripts (resource) and references (resource) components.

What problem does it solve? Manually mapping a target organization's DNS infrastructure during an authorized penetration test is slow and error-prone, and misconfigurations like open zone transfers or leaked internal IPs are easy to miss without a systematic workflow. ## Core Features & Use Cases - DNS Record Enumeration: Queries A, AAAA, MX, NS, TXT, SOA, SRV, and CAA records using dig, dnsrecon, and dnspython to map the target's DNS infrastructure. - Zone Transfer Testing: Attempts AXFR/IXFR transfers against each authoritative nameserver to detect servers that leak the entire zone file. - Subdomain Discovery: Combines passive sources (subfinder, amass, certificate transparency) with active brute-forcing (gobuster, wordlists) and reverse DNS sweeps. - Email Security Audit: Checks SPF, DKIM, and DMARC records to identify spoofing risks and weak policies. - Use Case: During an authorized external assessment, a consultant runs the workflow against example.com, discovers that ns2 allows zone transfers exposing 347 records, finds 15 subdomains leaking RFC1918 internal addresses, and reports an exposed staging environment. ## Quick Start Ask the agent to run DNS enumeration and zone transfer checks against an authorized target domain such as example.com and produce a findings report.

Frequently Asked Questions about performing-dns-enumeration-and-zone-transfer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform DNS enumeration and zone transfer testing?▼

Query NS and SOA records with dig to identify authoritative nameservers, then attempt AXFR transfers against each one using dig AXFR or dnsrecon -t axfr. Follow up with subdomain brute-forcing via gobuster or dnsenum and passive discovery with subfinder and amass.

What tools are best for subdomain enumeration?▼

subfinder and amass provide fast passive discovery from certificate transparency logs and search engines, while gobuster and dnsrecon perform active brute-forcing with wordlists like SecLists. Combining both approaches and deduplicating results yields the most complete subdomain list.

Does the DNS enumeration script require any Python libraries?▼

The scripts/agent.py script requires dnspython, which provides dns.resolver for record queries, dns.query.xfr for zone transfers, and dns.zone for parsing transfer results. Install it with pip install dnspython before running the script.

Why does a zone transfer attempt fail with REFUSED or FORMERR?▼

A REFUSED or FORMERR response means the nameserver is correctly configured to deny AXFR requests from unauthorized sources, which is the secure default. Zone transfers only succeed against misconfigured servers, and that misconfiguration is the finding to report.

When should I not use DNS brute-force enumeration?▼

Do not use it against domains without written authorization, for DNS amplification or reflection attacks, or at query rates that could overwhelm servers and trigger DDoS protections. Also check for wildcard DNS records first, since they cause false positive subdomain results.

Related Skills

Explore More Software Engineering Skills→
GarrettRoiGarrettRoi

domain-intel

Perform passive domain reconnaissance via Certificate Transparency, SSL, WHOIS, and DNS checks.

Community
Intermediate
AeonDaveAeonDave
15

nmap

Scan networks for hosts, ports, services, and operating systems.

Community
Intermediate
AxxxxxxaaannAxxxxxxaaann

building-adversary-infrastructure-tracking-system

Map threat actor infrastructure from passive DNS, WHOIS, and certificate data.

Community
Advanced
hoanghn61hoanghn61

subdomain-enumeration

Enumerate subdomains via certificate transparency logs and search-engine dorks.

Community
Advanced