It is very easy to resolve any domain in Microsoft Windows natively using the command nslookup:

C:\Users\defensahacker>nslookup www.google.com
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    www.google.com
Addresses:  2a00:1450:4003:805::2004
          216.58.211.228

By default our system will query to our predefined DNS server. If we want to query an specific DNS server, we can specify it as a second argument.

In this case we ask the IP address of the domain www.google.com to Google's own DNS server (8.8.8.8):

C:\Users\defensahacker>nslookup www.google.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    www.google.com
Addresses:  2a00:1450:4003:808::2004
          142.250.185.4

More enumeration techniques here:

Learn Pentesting like a Pro

🥷 Enumeration Cheat Sheet for the 25 most used protocols: From DNS to ElasticSearch

#1: DNS Enumeration nmap -T4 -sS -p 53 $IP/24 Enumerate ALL DNS records! Maybe hidden hosts in network recon dig -t all target1 target2 target3 @$DNSSERVER DNS recon (brute force subdomains): dnsrecon -d $IP -t brt -D /usr/share/wordlists/dnsmap.txt dnsenum $DOMAIN fierce -dns $DOMAIN -wordlist dictionary.txt…

Read more

3 months ago · pentesting.academy