| Command | Description |
|---|---|
dig ns <domain.tld> @<nameserver> | NS request to the specific nameserver. |
dig any <domain.tld> @<nameserver> | ANY request to the specific nameserver. |
dig axfr <domain.tld> @<nameserver> | AXFR request to the specific nameserver. |
dnsenum --dnsserver <nameserver> --enum -p 0 -s 0 -o found_subdomains.txt -f ~/subdomains.list <domain.tld> | Subdomain brute forcing. |