> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/network/common-protocols/dns.md).

# DNS

## DNS

DNS is useful for all sorts of things - finding internal web servers by subdomain, locating orphaned DNS records for Kerberos shenanigans, and even just locating domain controllers. Try doing zone transfers or brute forcing subdomains.

**Locate Domain Controllers**

```
dig SRV _ldap._tcp.dc._msdcs.contoso.com
```

**Zone Transfer**

```
dig axfr contoso.com
```