Enumerating DNS using the host command

The previous section covered how we could find subdomains using the publicly available Google search engine. While this is great, we should never assume that all subdomains can be found through such a method. The next few sections will cover finding subdomains using active discovery methods.

Getting ready

To prepare for working with the host command, all you need is to open a Terminal from your Kali Linux distribution.

Note

The host command is a standard command for Unix, Linux, and macOS systems.

How to do it...

Working with host command:

1. DNS servers are address books; for this reason normally they will divulge at least some information regarding the domains they are the authority for. The host command is a utility that performs DNS lookups. So we can use the host command to investigate information about our target domain. We can use the -a flag to do a comprehensive look up or use the -t flag followed by the type to get specific:

2. The following command will...