Attempt DNS Zone Transfer
reconchecklist
Summary
Try DNS AXFR; also try knock for port knocking targets.
Walkthrough
Attempt a DNS zone transfer to pull all records from the target nameserver. A hit is a full AXFR record dump, or a knock sequence that opens previously filtered ports.
Commands
bash
dig axfr @<IP> <DOMAIN>
bash
knock -v <IP> <PORT1> <PORT2> <PORT3>