Can someone explain how the enumeration of subdomains on a hostname works?
I know that zone transfers is one way, but I looked up one of my domains and it includes a private subdomain I've never published anywhere.
I checked and my DNS provider does not allow zone transfers (as far as I can tell) so I'm curious how this information is obtainable.
And I mean through ordinary means, let's ignore the "your account/ISP/Registrar may be compromised" scenarios. Are there everyday scanning tools that allow for this?
Can someone explain how the enumeration of subdomains on a hostname works?
I know that zone transfers is one way, but I looked up one of my domains and it includes a private subdomain I've never published anywhere.
I checked and my DNS provider does not allow zone transfers (as far as I can tell) so I'm curious how this information is obtainable.
And I mean through ordinary means, let's ignore the "your account/ISP/Registrar may be compromised" scenarios. Are there everyday scanning tools that allow for this?