Question

During passive reconnaissance of a target organization, a penetration tester wants to discover subdomains and internal-sounding hostnames (such as vpn.example.com and dev-api.example.com) without sending any packets to the target's infrastructure. Which technique will BEST accomplish this goal?

Accepted Answer

Query Certificate Transparency logs via crt.sh for certificates issued to the target's domain

Answer

Run an Nmap scan with the -sn flag against the target's published IP range

Answer

Attempt an AXFR zone transfer against the target's authoritative name servers

Answer

Use dnsrecon to brute-force subdomains with a large wordlist against the target DNS server