During this chapter, we covered various DNS interrogation techniques using a variety of tools to discover important servers, subdomains, and IP addresses, and were able to successfully extract the zone files from a DNS server (zone transfer) due to a misconfiguration on the target's DNS server.

Then, we used Nmap to perform various types of port scanning to determine the port status, running services and their versions, and the target's operating system; we also gained an indication of whether there's a firewall on the target. Finally, to close this chapter, we performed SMB and LDAP enumeration to gather user shares and directory records on our network devices.

Now that you have completed this chapter, you'll be able to successfully perform DNS zone transfers on vulnerable DNS servers; profile a system to discover its operating system, running services...