Still stuck?
go here if you get stuck in your mind
Stack Overflow
search a question related with company. You can search for a user who work at the target company an look at their questions about code or software error.
// check the port
proxychains -q nmap -sT -Pn -n $IP -oN nmapTCP -v
// more scan
proxychains -q nmap -sT -Pn -n $IP -oN nmapTCP -v -sC -sV -p<port>
host $URLh
host -t mx $URL
host -t txt $URL
# sub domain
for sub in $(cat list.txt); do host $sub.example.com; done
# reverse lookup IP address
for ip in $(seq 50 100); do host 10.10.10.$ip; done |grep -v "not found"
# check the dns server first
host -t ns example.com | cut -d " " -f 4
# then check the sub domain from that dns server address
#host -l <domain name> <dns server address>
host -l example.com ns1.example.com
#!/bin/bash
domain=$1
if [ -z "$domain" ]
then
echo "Usage : $0 <domain>"
exit 0
fi
for server in `host -t ns $domain |cut -d " " -f 4`
do
host -l $domain $server |grep "has address"
done
# query the DNS Zone Transfer
dnsrecon -d <domain> -t axfr
# brute force sub domain with dnsrecon
dnsrecon -d <domain> -D ./list.txt -t brt
