Active Infrastructure Identification
Active Subdomain Enumeration
1. Identifying Nameservers
Copy nslookup -type=NS zonetransfer.me 2. Testing for ANY and AXFR Zone Transfer
Copy nslookup -type=any -query=AXFR zonetransfer.me nsztm1.digi.ninja
Copy export TARGET = "facebook.com"
Copy export NS = "d.ns.facebook.com"
Copy export WORDLIST = "numbers.txt"
Copy gobuster dns -q -r "${NS}" -d "${TARGET}" -w "${WORDLIST}" -p ./patterns.txt -o "gobuster_${TARGET}.txt"
Found: lert-api-shv-01-sin6.facebook.com
Found: atlas-pp-shv-01-sin6.facebook.com
Found: atlas-pp-shv-02-sin6.facebook.com
Found: atlas-pp-shv-03-sin6.facebook.com
Found: lert-api-shv-03-sin6.facebook.com
Found: lert-api-shv-02-sin6.facebook.com
Found: lert-api-shv-04-sin6.facebook.com
Found: atlas-pp-shv-04-sin6.facebook.com
Copy ffuf -w ./vhosts -u http://192.168.10.10 -H "HOST: FUZZ.randomtarget.com" -fs 612
Copy ffuf -recursion -recursion-depth 1 -u http://192.168.10.10/FUZZ -w /opt/useful/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt 
