Check Possible Subdomains
checklist
Walkthrough
Query the domain's DNS for subdomains and records, including attempting a zone transfer. New hostnames can reveal additional in-scope hosts and services.
Commands
bash
dnsrecon -d '<DOMAIN>' -n <IP>
Query the domain's DNS for subdomains and records, including attempting a zone transfer. New hostnames can reveal additional in-scope hosts and services.
bash
dnsrecon -d '<DOMAIN>' -n <IP>