
You are enumerating DNS infrastructure for a target organization as part of an authorized penetration test.

**Basic DNS Queries**
- What record types should you query for every target domain? (A, AAAA, MX, NS, TXT, CNAME, SOA, SRV, PTR)
- What does an SPF record tell you about mail infrastructure?
- What do DMARC and DKIM records reveal about email security posture?
- What do SRV records reveal about internal services?

**Zone Transfer Attack**
- What is a DNS zone transfer (AXFR) and why is it a vulnerability?
- How do you test for zone transfer misconfigurations?
- What do you get if zone transfer succeeds?

**Subdomain Enumeration**
- What is the difference between passive and active subdomain enumeration?
- Which certificate transparency logs can you use to find subdomains?
- How do you use brute force wordlists vs permutation tools for subdomain discovery?
- How do you handle wildcard DNS responses during brute force?

**Reverse DNS & PTR Records**
- How do you enumerate a netblock's reverse DNS records?
- What can PTR records reveal about internal infrastructure?

**DNS as an Attack Vector**
- What is DNS cache poisoning and when is it relevant in a pentest?
- What is DNS rebinding and what application-layer attacks does it enable?
- How is DNS used for data exfiltration in post-exploitation scenarios?

Output:
- Complete DNS enumeration command reference
- Findings interpretation guide
- Tools: dig, dnsx, amass, subfinder, massdns


DNS Enumeration & Zone Transfer


You are a penetration tester in the early phases of an engagement. You have identified a range of live hosts and need to enumerate services systematically.

**Port Scanning Strategy**
- What is the difference between TCP SYN, TCP connect, and UDP scanning?
- How do you balance scan speed against detection risk?
- What ports do you scan first: top 1000, top 100, or full 65535?
- How do you handle hosts that appear to have all ports filtered?

**Service Fingerprinting**
- Once a port is open, how do you determine the exact service and version?
- What does banner grabbing tell you and where does it fall short?
- How do you enumerate services when they are running on non-standard ports?

**Per-Service Enumeration**
- **SSH (22):** What version-based vulnerabilities are common? What authentication methods are enabled?
- **HTTP/HTTPS (80/443):** What is your web application enumeration starting point?
- **FTP (21):** How do you check for anonymous login and what do you look for?
- **SMTP (25):** How do you enumerate valid users via VRFY/EXPN?
- **SNMP (161/UDP):** What community strings do you try? What information does SNMP expose?
- **RPC/NFS:** What does rpcinfo reveal? How do you list NFS exports?

**Version Research**
- Given a service version string, how do you quickly find known CVEs?
- How do you distinguish between a real vulnerability and a false positive from a scanner?

Output:
- Priority port scanning order with rationale
- Per-service enumeration checklist
- Tool command reference (nmap, netcat, enum4linux, snmpwalk)


Network Service Enumeration


You have discovered SMB open on a Windows host during a penetration test. Plan a complete enumeration campaign.

**Unauthenticated Enumeration**
- What information can you gather from SMB without credentials? (OS version, hostname, domain, signing status)
- What is the difference between SMBv1, SMBv2, and SMBv3 from an attack surface perspective?
- How do you check if SMB signing is enforced and why does it matter for relay attacks?
- Can you enumerate shares without credentials? What tools and what to look for?

**Authenticated Enumeration**
- With a valid username and password, what do you enumerate first?
- How do you map readable and writable shares?
- What is the significance of finding SYSVOL or NETLOGON access?
- How do you enumerate Active Directory via LDAP over SMB?

**Common Vulnerabilities to Check**
- EternalBlue (MS17-010): How do you safely test for it without exploiting?
- PrintNightmare: What conditions make a host vulnerable?
- NTLMv1 downgrade: How do you test for it and why is it critical?

**Data Inside Shares**
- Once you have read access to shares, what files are highest priority?
- How do you search recursively for passwords, credentials, or sensitive configs?
- What file extensions indicate scripts, configs, or backup data?

**NTLM Relay Setup**
- If SMB signing is not required, how does an NTLM relay attack work?
- What is the prerequisite chain: Responder → NTLMRelayX → target?

Output:
- Tool-by-tool enumeration workflow (nmap, smbclient, crackmapexec, enum4linux-ng)
- Quick-win checklist
- Common finding descriptions for report writing


SMB & Windows Share Enumeration


You have identified a web application on a target host. Perform thorough passive and active fingerprinting before active exploitation.

**Technology Stack Identification**
- How do you identify the web server, framework, and language from HTTP response headers?
- What do cookies reveal about the backend technology? (JSESSIONID → Java, PHPSESSID → PHP, ASP.NET_SessionId)
- How do you identify CMS platforms? (WordPress, Drupal, Joomla, Magento)
- What do the page structure, URL patterns, and error messages tell you?

**Content Discovery**
- What is the difference between directory brute-forcing and content discovery?
- How do you choose a wordlist for directory enumeration?
- What HTTP response codes tell you something interesting? (200, 301, 302, 403, 500)
- How do you handle rate limiting during content discovery?

**JavaScript & Client-Side Analysis**
- What can you learn from JavaScript files? (API endpoints, secrets, internal paths)
- How do you extract URLs and endpoints from source code?
- What do source maps (.map files) reveal?

**Robots.txt, Sitemap, & Metadata**
- Why check robots.txt even when it says "Disallow"?
- What does a sitemap.xml reveal about application structure?
- How do you use Google dorking to discover indexed content of a target?

**API Enumeration**
- How do you discover API endpoints on a web application?
- What does swagger.json or openapi.json reveal?
- How do you test API versioning for outdated endpoints?

Output:
- Fingerprinting checklist ordered by information value
- Tool list: Wappalyzer, whatweb, gobuster, ffuf, burpsuite
- Common fingerprint patterns and what they imply


Enumeration

DNS Enumeration & Zone Transfer

Network Service Enumeration

SMB & Windows Share Enumeration

Web Application Fingerprinting