Zone enumeration is the low-noise way to turn DNS into an internal map. We enumerate records through DNS queries, AXFR if misconfigured, LDAP if we have domain credentials, and local DNS tooling if we are on a domain controller.
Variables
export DOMAIN=ootw.local
export DC=10.10.10.200
export USER=student
export PASS='student'
Basic DNS records
dig @$DC $DOMAIN SOA
dig @$DC $DOMAIN NS
dig @$DC $DOMAIN MX
dig @$DC $DOMAIN TXT
dig @$DC $DOMAIN ANY
SRV records
dig @$DC _ldap._tcp.$DOMAIN SRV
dig @$DC _ldap._tcp.dc._msdcs.$DOMAIN SRV
dig @$DC _kerberos._tcp.$DOMAIN SRV
dig @$DC _gc._tcp.$DOMAIN SRV
AXFR
dig @$DC $DOMAIN AXFR
dig @$DC _msdcs.$DOMAIN AXFR
adidnsdump
adidnsdump -u "$DOMAIN\\$USER" -p "$PASS" ldap://$DC
adidnsdump -u "$DOMAIN\\$USER" -p "$PASS" ldap://$DC -r
LDAP query
ldapsearch -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "DC=DomainDnsZones,DC=ootw,DC=local" "(objectClass=dnsNode)" name dnsRecord
Windows PowerShell
Get-DnsServerZone -ComputerName dc01.ootw.local
Get-DnsServerResourceRecord -ComputerName dc01.ootw.local -ZoneName ootw.local
Get-DnsServerResourceRecord -ComputerName dc01.ootw.local -ZoneName _msdcs.ootw.local
dnscmd
dnscmd /enumzones
dnscmd /zoneprint ootw.local
dnscmd /zoneexport ootw.local ootw.local.zone
Resolve host list
while read h; do dig +short @$DC "$h.$DOMAIN" | sed "s/^/$h.$DOMAIN /"; done < hosts.txt
Interesting names
dc, dc01, ad, ldap, kerberos
ca, pki, certsrv
sql, mssql, db, database
file, files, share, fs, nas
web, intranet, portal, app
backup, veeam, monitor, sccm
wpad, proxy, isatap
What to keep
Hostnames that imply roles
Records pointing to old or unreachable IPs
Records for PKI and ADCS
MSSQL names
File server names
WPAD or proxy names
Names that users or services are likely to access