[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFREVTXQCBAT08Y6M5123K":3,"skill-same:01M6AFREVTXQCBAT08Y6M5123K":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6AFREVTXQCBAT08Y6M5123K","performing-dns-enumeration-and-zone-transfer",null,"Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dns-enumeration-and-zone-transfer\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35],"transfer","dns","enumeration","performing dns enumeration and zone transfer","security","cybersecurity","pr","infrastructure","network","network-security","reconnaissance","zone-transfer","2026-11-10 10:12:30",false,"---\nname: performing-dns-enumeration-and-zone-transfer\ndescription: 'Enumerates DNS records, attempts zone transfers, brute-forces subdomains,\n  and maps DNS infrastructure during authorized reconnaissance to identify attack\n  surface, misconfigurations, and information disclosure in target domains.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- dns\n- enumeration\n- zone-transfer\n- reconnaissance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1595\n---\n# Performing DNS Enumeration and Zone Transfer\n\n## When to Use\n\n- Mapping the external attack surface of a target organization during authorized penetration tests\n- Discovering hidden subdomains, internal hostnames, and IP addresses exposed via DNS records\n- Testing whether DNS servers allow unauthorized zone transfers that leak the entire zone file\n- Identifying mail servers, name servers, and service records for further targeted testing\n- Validating DNS security configurations including DNSSEC, SPF, DKIM, and DMARC\n\n**Do not use** against domains you do not have authorization to test, for DNS amplification or reflection attacks, or to overwhelm DNS servers with excessive query volumes.\n\n## Prerequisites\n\n- Written authorization to perform DNS enumeration against the target domain\n- DNS enumeration tools installed: dig, nslookup, host, dnsrecon, dnsenum, subfinder, amass\n- Network access to the target's DNS servers (UDP\u002FTCP port 53)\n- Wordlist for subdomain brute-forcing (SecLists dns-wordlist or similar)\n- Understanding of DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, PTR)\n\n## Workflow\n\n### Step 1: Identify DNS Servers and Basic Records\n\n```bash\n# Find authoritative name servers\ndig NS example.com +short\n# ns1.example.com.\n# ns2.example.com.\n\n# Get SOA record for zone metadata\ndig SOA example.com +short\n# ns1.example.com. admin.example.com. 2024031501 3600 900 604800 86400\n\n# Enumerate all common record types\ndig example.com ANY +noall +answer\n\n# Get MX records (mail servers)\ndig MX example.com +short\n# 10 mail.example.com.\n# 20 mail-backup.example.com.\n\n# Get TXT records (SPF, DKIM, DMARC, verification)\ndig TXT example.com +short\n\n# Check for DMARC policy\ndig TXT _dmarc.example.com +short\n\n# Check for DKIM selectors\ndig TXT default._domainkey.example.com +short\ndig TXT selector1._domainkey.example.com +short\ndig TXT google._domainkey.example.com +short\n\n# Get SRV records for common services\ndig SRV _sip._tcp.example.com +short\ndig SRV _ldap._tcp.example.com +short\ndig SRV _kerberos._tcp.example.com +short\n```\n\n### Step 2: Attempt Zone Transfers\n\n```bash\n# Attempt AXFR zone transfer against each name server\ndig AXFR example.com @ns1.example.com\ndig AXFR example.com @ns2.example.com\n\n# Use host command for zone transfer\nhost -t axfr example.com ns1.example.com\n\n# Use dnsrecon for automated zone transfer attempts\ndnsrecon -d example.com -t axfr\n\n# If zone transfer succeeds, save the output\ndig AXFR example.com @ns1.example.com > zone_transfer_results.txt\n\n# Test for IXFR (incremental zone transfer)\ndig IXFR=2024031500 example.com @ns1.example.com\n```\n\n### Step 3: Subdomain Enumeration via Brute Force\n\n```bash\n# Use dnsenum for comprehensive enumeration\ndnsenum --dnsserver ns1.example.com --enum -f \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-5000.txt -r example.com -o dnsenum_output.xml\n\n# Use dnsrecon with brute force\ndnsrecon -d example.com -t brt -D \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-5000.txt\n\n# Use gobuster for fast DNS brute forcing\ngobuster dns -d example.com -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-20000.txt -t 50 -o gobuster_dns.txt\n\n# Use subfinder for passive subdomain discovery\nsubfinder -d example.com -all -o subfinder_results.txt\n\n# Use amass for comprehensive enumeration (passive + active)\namass enum -d example.com -passive -o amass_passive.txt\namass enum -d example.com -active -brute -o amass_active.txt\n\n# Combine and deduplicate results\ncat subfinder_results.txt amass_passive.txt amass_active.txt gobuster_dns.txt | sort -u > all_subdomains.txt\n```\n\n### Step 4: Reverse DNS and PTR Enumeration\n\n```bash\n# Reverse DNS lookup on discovered IP ranges\ndnsrecon -d example.com -t rvl -r 10.10.0.0\u002F24\n\n# PTR record enumeration for IP range\nfor ip in $(seq 1 254); do\n  result=$(dig -x 10.10.1.$ip +short 2>\u002Fdev\u002Fnull)\n  if [ -n \"$result\" ]; then\n    echo \"10.10.1.$ip -> $result\"\n  fi\ndone\n\n# Use Nmap for reverse DNS on a subnet\nnmap -sL 10.10.0.0\u002F24 | grep \"(\" | awk '{print $5, $6}'\n\n# Check for DNS cache snooping (information about queried domains)\ndig @ns1.example.com www.competitor.com +norecurse\n```\n\n### Step 5: Analyze DNS Security Configuration\n\n```bash\n# Check DNSSEC validation\ndig example.com +dnssec +short\ndig DNSKEY example.com +short\ndig DS example.com +short\n\n# Test for DNS rebinding vulnerability\n# Check if the DNS server has a short TTL that could enable rebinding\ndig example.com +noall +answer | grep -i ttl\n\n# Check for open recursive resolver (misconfiguration)\ndig @ns1.example.com google.com +recurse\n# If it resolves, the server is an open resolver\n\n# Check for wildcard DNS records\ndig nonexistent-subdomain-xyz123.example.com +short\n# If it resolves, a wildcard record exists\n\n# Test DNS over HTTPS\u002FTLS support\n# DoH test\ncurl -s -H 'accept: application\u002Fdns-json' 'https:\u002F\u002Fdns.google\u002Fresolve?name=example.com&type=A'\n\n# Verify SPF record for email security\ndig TXT example.com +short | grep \"v=spf1\"\n# Check for overly permissive SPF (+all, ?all)\n```\n\n### Step 6: Resolve and Map All Discovered Subdomains\n\n```bash\n# Resolve all discovered subdomains to IP addresses\nwhile read subdomain; do\n  ip=$(dig +short A \"$subdomain\" | head -1)\n  if [ -n \"$ip\" ]; then\n    echo \"$subdomain,$ip\"\n  fi\ndone \u003C all_subdomains.txt > resolved_subdomains.csv\n\n# Identify unique IP addresses and their locations\ncut -d',' -f2 resolved_subdomains.csv | sort -u > unique_ips.txt\n\n# Check for internal IP addresses leaked via DNS\ngrep -E \"^10\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.|^192\\.168\\.\" resolved_subdomains.csv > internal_ip_leaks.txt\n\n# Use httpx to probe web services on discovered subdomains\ncat all_subdomains.txt | httpx -title -status-code -tech-detect -o httpx_results.txt\n\n# Screenshot web services for documentation\ncat all_subdomains.txt | httpx -screenshot -o screenshots\u002F\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Zone Transfer (AXFR)** | DNS mechanism that replicates the complete zone file from a primary to secondary server; unauthorized transfers expose all records in the zone |\n| **Subdomain Enumeration** | Process of discovering valid subdomains through brute force, certificate transparency logs, search engines, and passive DNS databases |\n| **DNSSEC** | DNS Security Extensions that add cryptographic signatures to DNS responses, preventing cache poisoning and spoofing attacks |\n| **SPF\u002FDKIM\u002FDMARC** | Email authentication protocols defined in DNS TXT records that prevent email spoofing and domain impersonation |\n| **Wildcard DNS** | A DNS record using an asterisk (*) that matches any query for non-existent subdomains, potentially masking enumeration results |\n| **PTR Record** | Reverse DNS record that maps an IP address to a hostname, often revealing internal naming conventions and server roles |\n\n## Tools & Systems\n\n- **dig**: Standard DNS lookup utility with full support for all record types, DNSSEC validation, and zone transfer queries\n- **dnsrecon**: Comprehensive DNS enumeration tool supporting zone transfers, brute force, reverse lookup, cache snooping, and Google dork queries\n- **subfinder**: Fast passive subdomain discovery tool that queries certificate transparency logs, search engines, and DNS databases\n- **Amass (OWASP)**: Advanced attack surface mapping tool with both passive and active DNS enumeration, graph analysis, and data source integration\n- **gobuster**: Fast brute-force tool for DNS subdomain enumeration using configurable wordlists and concurrent threads\n\n## Common Scenarios\n\n### Scenario: External Reconnaissance for a Web Application Penetration Test\n\n**Context**: A security consultant is performing external reconnaissance for a web application penetration test. The client's primary domain is example.com, and the scope includes all subdomains and related infrastructure. The consultant has authorization to enumerate DNS records and probe discovered web services.\n\n**Approach**:\n1. Query NS, MX, TXT, and SOA records for example.com to map the DNS infrastructure\n2. Attempt zone transfers against both nameservers -- ns2 succeeds, revealing 347 DNS records including internal staging environments\n3. Run subfinder and amass in passive mode to discover 89 additional subdomains from certificate transparency logs\n4. Brute-force subdomains with a 20,000-word list using gobuster, discovering 12 more subdomains not found in passive sources\n5. Resolve all subdomains and identify 15 that resolve to internal RFC1918 addresses (information disclosure)\n6. Probe all web-accessible subdomains with httpx, discovering a staging environment (staging.example.com) with default credentials\n7. Report zone transfer vulnerability, internal IP disclosure, and exposed staging environment to the client\n\n**Pitfalls**:\n- Sending thousands of DNS queries per second and triggering rate limiting or DNS-based DDoS protection\n- Not checking for wildcard DNS records, resulting in false positive subdomain discoveries\n- Missing subdomains that use separate DNS providers or CDN-specific CNAME records\n- Overlooking TXT records that contain API keys, verification tokens, or internal comments\n\n## Output Format\n\n```\n## DNS Enumeration Report\n\n**Target Domain**: example.com\n**Authorized Nameservers**: ns1.example.com (203.0.113.10), ns2.example.com (203.0.113.11)\n\n### Zone Transfer Status\n| Nameserver | AXFR Result | Records Obtained |\n|------------|-------------|------------------|\n| ns1.example.com | REFUSED | 0 |\n| ns2.example.com | SUCCESS | 347 records |\n\n### Subdomain Discovery Summary\n| Method | Subdomains Found |\n|--------|-----------------|\n| Zone Transfer | 347 |\n| Passive (subfinder + amass) | 89 |\n| Active Brute Force | 12 |\n| **Total Unique** | **412** |\n\n### Critical Findings\n1. **Zone Transfer Allowed** (High): ns2.example.com allows AXFR from any source\n2. **Internal IP Disclosure** (Medium): 15 subdomains resolve to RFC1918 addresses\n3. **Exposed Staging Environment** (High): staging.example.com accessible with default credentials\n4. **Missing DMARC Policy** (Medium): No DMARC record found, enabling email spoofing\n5. **Weak SPF Record** (Low): SPF uses ~all (soft fail) instead of -all (hard fail)\n```\n","# Performing DNS Enumeration and Zone Transfer\n\n## When to Use\n\n- Mapping the external attack surface of a target organization during authorized penetration tests\n- Discovering hidden subdomains, internal hostnames, and IP addresses exposed via DNS records\n- Testing whether DNS servers allow unauthorized zone transfers that leak the entire zone file\n- Identifying mail servers, name servers, and service records for further targeted testing\n- Validating DNS security configurations including DNSSEC, SPF, DKIM, and DMARC\n\n**Do not use** against domains you do not have authorization to test, for DNS amplification or reflection attacks, or to overwhelm DNS servers with excessive query volumes.\n\n## Prerequisites\n\n- Written authorization to perform DNS enumeration against the target domain\n- DNS enumeration tools installed: dig, nslookup, host, dnsrecon, dnsenum, subfinder, amass\n- Network access to the target's DNS servers (UDP\u002FTCP port 53)\n- Wordlist for subdomain brute-forcing (SecLists dns-wordlist or similar)\n- Understanding of DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, PTR)\n\n## Workflow\n\n### Step 1: Identify DNS Servers and Basic Records\n\n```bash\n# Find authoritative name servers\ndig NS example.com +short\n# ns1.example.com.\n# ns2.example.com.\n\n# Get SOA record for zone metadata\ndig SOA example.com +short\n# ns1.example.com. admin.example.com. 2024031501 3600 900 604800 86400\n\n# Enumerate all common record types\ndig example.com ANY +noall +answer\n\n# Get MX records (mail servers)\ndig MX example.com +short\n# 10 mail.example.com.\n# 20 mail-backup.example.com.\n\n# Get TXT records (SPF, DKIM, DMARC, verification)\ndig TXT example.com +short\n\n# Check for DMARC policy\ndig TXT _dmarc.example.com +short\n\n# Check for DKIM selectors\ndig TXT default._domainkey.example.com +short\ndig TXT selector1._domainkey.example.com +short\ndig TXT google._domainkey.example.com +short\n\n# Get SRV records for common services\ndig SRV _sip._tcp.example.com +short\ndig SRV _ldap._tcp.example.com +short\ndig SRV _kerberos._tcp.example.com +short\n```\n\n### Step 2: Attempt Zone Transfers\n\n```bash\n# Attempt AXFR zone transfer against each name server\ndig AXFR example.com @ns1.example.com\ndig AXFR example.com @ns2.example.com\n\n# Use host command for zone transfer\nhost -t axfr example.com ns1.example.com\n\n# Use dnsrecon for automated zone transfer attempts\ndnsrecon -d example.com -t axfr\n\n# If zone transfer succeeds, save the output\ndig AXFR example.com @ns1.example.com > zone_transfer_results.txt\n\n# Test for IXFR (incremental zone transfer)\ndig IXFR=2024031500 example.com @ns1.example.com\n```\n\n### Step 3: Subdomain Enumeration via Brute Force\n\n```bash\n# Use dnsenum for comprehensive enumeration\ndnsenum --dnsserver ns1.example.com --enum -f \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-5000.txt -r example.com -o dnsenum_output.xml\n\n# Use dnsrecon with brute force\ndnsrecon -d example.com -t brt -D \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-5000.txt\n\n# Use gobuster for fast DNS brute forcing\ngobuster dns -d example.com -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FDNS\u002Fsubdomains-top1million-20000.txt -t 50 -o gobuster_dns.txt\n\n# Use subfinder for passive subdomain discovery\nsubfinder -d example.com -all -o subfinder_results.txt\n\n# Use amass for comprehensive enumeration (passive + active)\namass enum -d example.com -passive -o amass_passive.txt\namass enum -d example.com -active -brute -o amass_active.txt\n\n# Combine and deduplicate results\ncat subfinder_results.txt amass_passive.txt amass_active.txt gobuster_dns.txt | sort -u > all_subdomains.txt\n```\n\n### Step 4: Reverse DNS and PTR Enumeration\n\n```bash\n# Reverse DNS lookup on discovered IP ranges\ndnsrecon -d example.com -t rvl -r 10.10.0.0\u002F24\n\n# PTR record enumeration for IP range\nfor ip in $(seq 1 254); do\n  result=$(dig -x 10.10.1.$ip +short 2>\u002Fdev\u002Fnull)\n  if [ -n \"$result\" ]; then\n    echo \"10.10.1.$ip -> $result\"\n  fi\ndone\n\n# Use Nmap for reverse DNS on a subnet\nnmap -sL 10.10.0.0\u002F24 | grep \"(\" | awk '{print $5, $6}'\n\n# Check for DNS cache snooping (information about queried domains)\ndig @ns1.example.com www.competitor.com +norecurse\n```\n\n### Step 5: Analyze DNS Security Configuration\n\n```bash\n# Check DNSSEC validation\ndig example.com +dnssec +short\ndig DNSKEY example.com +short\ndig DS example.com +short\n\n# Test for DNS rebinding vulnerability\n# Check if the DNS server has a short TTL that could enable rebinding\ndig example.com +noall +answer | grep -i ttl\n\n# Check for open recursive resolver (misconfiguration)\ndig @ns1.example.com google.com +recurse\n# If it resolves, the server is an open resolver\n\n# Check for wildcard DNS records\ndig nonexistent-subdomain-xyz123.example.com +short\n# If it resolves, a wildcard record exists\n\n# Test DNS over HTTPS\u002FTLS support\n# DoH test\ncurl -s -H 'accept: application\u002Fdns-json' 'https:\u002F\u002Fdns.google\u002Fresolve?name=example.com&type=A'\n\n# Verify SPF record for email security\ndig TXT example.com +short | grep \"v=spf1\"\n# Check for overly permissive SPF (+all, ?all)\n```\n\n### Step 6: Resolve and Map All Discovered Subdomains\n\n```bash\n# Resolve all discovered subdomains to IP addresses\nwhile read subdomain; do\n  ip=$(dig +short A \"$subdomain\" | head -1)\n  if [ -n \"$ip\" ]; then\n    echo \"$subdomain,$ip\"\n  fi\ndone \u003C all_subdomains.txt > resolved_subdomains.csv\n\n# Identify unique IP addresses and their locations\ncut -d',' -f2 resolved_subdomains.csv | sort -u > unique_ips.txt\n\n# Check for internal IP addresses leaked via DNS\ngrep -E \"^10\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.|^192\\.168\\.\" resolved_subdomains.csv > internal_ip_leaks.txt\n\n# Use httpx to probe web services on discovered subdomains\ncat all_subdomains.txt | httpx -title -status-code -tech-detect -o httpx_results.txt\n\n# Screenshot web services for documentation\ncat all_subdomains.txt | httpx -screenshot -o screenshots\u002F\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Zone Transfer (AXFR)** | DNS mechanism that replicates the complete zone file from a primary to secondary server; unauthorized transfers expose all records in the zone |\n| **Subdomain Enumeration** | Process of discovering valid subdomains through brute force, certificate transparency logs, search engines, and passive DNS databases |\n| **DNSSEC** | DNS Security Extensions that add cryptographic signatures to DNS responses, preventing cache poisoning and spoofing attacks |\n| **SPF\u002FDKIM\u002FDMARC** | Email authentication protocols defined in DNS TXT records that prevent email spoofing and domain impersonation |\n| **Wildcard DNS** | A DNS record using an asterisk (*) that matches any query for non-existent subdomains, potentially masking enumeration results |\n| **PTR Record** | Reverse DNS record that maps an IP address to a hostname, often revealing internal naming conventions and server roles |\n\n## Tools & Systems\n\n- **dig**: Standard DNS lookup utility with full support for all record types, DNSSEC validation, and zone transfer queries\n- **dnsrecon**: Comprehensive DNS enumeration tool supporting zone transfers, brute force, reverse lookup, cache snooping, and Google dork queries\n- **subfinder**: Fast passive subdomain discovery tool that queries certificate transparency logs, search engines, and DNS databases\n- **Amass (OWASP)**: Advanced attack surface mapping tool with both passive and active DNS enumeration, graph analysis, and data source integration\n- **gobuster**: Fast brute-force tool for DNS subdomain enumeration using configurable wordlists and concurrent threads\n\n## Common Scenarios\n\n### Scenario: External Reconnaissance for a Web Application Penetration Test\n\n**Context**: A security consultant is performing external reconnaissance for a web application penetration test. The client's primary domain is example.com, and the scope includes all subdomains and related infrastructure. The consultant has authorization to enumerate DNS records and probe discovered web services.\n\n**Approach**:\n1. Query NS, MX, TXT, and SOA records for example.com to map the DNS infrastructure\n2. Attempt zone transfers against both nameservers -- ns2 succeeds, revealing 347 DNS records including internal staging environments\n3. Run subfinder and amass in passive mode to discover 89 additional subdomains from certificate transparency logs\n4. Brute-force subdomains with a 20,000-word list using gobuster, discovering 12 more subdomains not found in passive sources\n5. Resolve all subdomains and identify 15 that resolve to internal RFC1918 addresses (information disclosure)\n6. Probe all web-accessible subdomains with httpx, discovering a staging environment (staging.example.com) with default credentials\n7. Report zone transfer vulnerability, internal IP disclosure, and exposed staging environment to the client\n\n**Pitfalls**:\n- Sending thousands of DNS queries per second and triggering rate limiting or DNS-based DDoS protection\n- Not checking for wildcard DNS records, resulting in false positive subdomain discoveries\n- Missing subdomains that use separate DNS providers or CDN-specific CNAME records\n- Overlooking TXT records that contain API keys, verification tokens, or internal comments\n\n## Output Format\n\n```\n## DNS Enumeration Report\n\n**Target Domain**: example.com\n**Authorized Nameservers**: ns1.example.com (203.0.113.10), ns2.example.com (203.0.113.11)\n\n### Zone Transfer Status\n| Nameserver | AXFR Result | Records Obtained |\n|------------|-------------|------------------|\n| ns1.example.com | REFUSED | 0 |\n| ns2.example.com | SUCCESS | 347 records |\n\n### Subdomain Discovery Summary\n| Method | Subdomains Found |\n|--------|-----------------|\n| Zone Transfer | 347 |\n| Passive (subfinder + amass) | 89 |\n| Active Brute Force | 12 |\n| **Total Unique** | **412** |\n\n### Critical Findings\n1. **Zone Transfer Allowed** (High): ns2.example.com allows AXFR from any source\n2. **Internal IP Disclosure** (Medium): 15 subdomains resolve to RFC1918 addresses\n3. **Exposed Staging Environment** (High): staging.example.com accessible with default credentials\n4. **Missing DMARC Policy** (Medium): No DMARC record found, enabling email spoofing\n5. **Weak SPF Record** (Low): SPF uses ~all (soft fail) instead of -all (hard fail)\n```\n",{"name":5,"tags":41,"author":42,"domain":29,"license":15,"version":43,"nist_csf":44,"subdomain":33,"description":49,"mitre_attack":50},[33,25,26,35,34],"mahipal","1.0",[45,46,47,48],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.\n",[51,52,53,54,55],"T1046","T1040","T1557","T1071","T1595","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-dns-enumeration-and-zone-transfer",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dns-enumeration-and-zone-transfer",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dns-enumeration-and-zone-transfer",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dns-enumeration-and-zone-transfer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dns-enumeration-and-zone-transfer\u002FSKILL.md",true,[80,85,91,97,101],{"path":81,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dns-enumeration-and-zone-transfer\u002FLICENSE",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi-reference.md","REFERENCE","参考文档",2198,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dns-enumeration-and-zone-transfer\u002Freferences\u002Fapi-reference.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fagent.py","SCRIPT","脚本",8492,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dns-enumeration-and-zone-transfer\u002Fscripts\u002Fagent.py",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fdatasets.sh",8601,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fdata-feeds\u002Fscripts\u002Fdatasets.sh",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Ffetch.sh",1895,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fdata-feeds\u002Fscripts\u002Ffetch.sh",[106,131,155,182,208,235],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":36},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,28,29,118,119,30,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":36},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,28,142,29,30,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":36},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,29,31,170,143,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":36},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,29,193,194,195,196,197,198,199,200,201,202,203,204,146,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":36},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,29,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":36},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[28,243,29,244,245,246,247,248,249,250,251,177,252,178,253,254,255,256,257,258],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]