> For the complete documentation index, see [llms.txt](https://ugur.gungor.biz.tr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ugur.gungor.biz.tr/recon/reconnaissance-enumeration.md).

# Reconnaissance / Enumeration

### DNS lookups, Zone Transfers & Brute-Force <a href="#dns-lookups-zone-transfers-and-brute-force" id="dns-lookups-zone-transfers-and-brute-force"></a>

```bash
whois domain.com
dig {a|txt|ns|mx} domain.com
dig {a|txt|ns|mx} domain.com @ns1.domain.com
host -t {a|txt|ns|mx} megacorpone.com
host -a megacorpone.com
host -l megacorpone.com ns1.megacorpone.com
dnsrecon -d megacorpone.com -t axfr @ns2.megacorpone.com
dnsenum domain.com
nslookup -> set type=any -> ls -d domain.com
for sub in $(cat subdomains.txt);do host $sub.domain.com|grep "has.address";done
```