I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/subbrute but this is for external domains only.

What would be the best way to do this?

  • 2
    The legal way would be to ask IT if you have authorisation to receive the information from them. Brute forcing anything on a corporate network may be a sackable offence. If you are a pen tester for them then it might be worth telling them you can't do it and to get someone more skilled. If you are the IT admin of the company and no longer know your subdomains then check with your DNS guys.
    Jun 29, 2017 at 7:39
  • there are numerous DNS enumeration tools available from multiple sources, including scripts written in bash and powershell
    – schroeder
    Jun 29, 2017 at 9:53

1 Answer 1


Internal DNS are widely configured to authorized zone transfert in the internal context.

you can use the tool fierce for example. It makes an initial AXFR request (zone transfert) or use dig @myinternaldns axfr mydomain.com

If these tools don't work, your company is not allowing internal zone transfert for security reasons and you should not try to pass over the internal security policy without asking them

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.