svc-dns

name	svc-dns
description	DNS attack techniques — zone transfer, subdomain enumeration/takeover, cache poisoning. Use when DNS is found or you're mapping a domain. Triggers - port 53, named/bind, AXFR zone transfer, dangling CNAME, subdomain takeover, wildcard DNS.

DNS Attack Reference

Zone Transfer (AXFR)

dig AXFR <domain> @<ns_server>
host -t AXFR <domain> <ns_server>
dnsrecon -d <domain> -a

DNS Enumeration

# Record types
dig <domain> ANY +noall +answer
dig <domain> A +short
dig <domain> AAAA +short
dig <domain> MX +short
dig <domain> NS +short
dig <domain> TXT +short
dig <domain> SOA +short
dig <domain> SRV +short

# Reverse DNS for IP range
dnsrecon -r <cidr>

# Brute force subdomains
dnsrecon -d <domain> -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t brt
dnsenum <domain>
fierce --domain <domain>

Subdomain Takeover

# Check for dangling CNAME records
dig CNAME <subdomain>
# If CNAME points to unclaimed resource (S3, Heroku, GitHub Pages, Azure) → takeover

# Automated check
subjack -w subdomains.txt -t 20 -o takeover_results.txt
nuclei -t takeovers/ -l subdomains.txt

DNS Cache Poisoning

# Check if recursion is open
dig @<target> example.com +recurse

# Test cache snooping (non-recursive query for cached records)
dig @<target> <popular_domain> +norecurse

DNS Tunneling Detection

# Unusually long subdomains or high query volume to single domain
# Tools: iodine, dnscat2 for establishing DNS tunnels