adidnsdump

adidnsdump (dirkjanm) abuses the fact that any authenticated domain user can read the AD-integrated DNS zones (stored in the DomainDnsZones/ForestDnsZones partitions), effectively performing a zone transfer without being a DNS admin. Records whose node name is hidden from the anonymous listing are still enumerable and can be resolved by adding -r, which issues a live DNS query for each hidden node. This maps internal hostnames to IPs for target selection; results are written to records.csv. Use --print-zones first to see which zones exist. Command Reference: Username: john Password: password123 Domain: test.local Target DC IP: 10.10.10.1

# List available DNS zones
adidnsdump -u 'test.local\john' -p password123 --print-zones ldap://10.10.10.1
# Dump the default zone; -r resolves nodes hidden from the unauthenticated listing (records.csv)
adidnsdump -u 'test.local\john' -p password123 -r ldap://10.10.10.1

Native

Enumeration, Discovery

MITRE

T1590.002

Requires

Username, Password

Services

DNS, LDAP

Refs

github.com/dirkjanm/adidnsdump

dirkjanm.io/getting-in-the-zone-dumping-active-directory-dns-with-adidnsdump/

attack.mitre.org/techniques/T1590/002/