If you have a box with port 53 open, run a ‘nslookup’ to see if we can find domain name(s).
**‘nslookup’ **
then enter IP of the box
We should see a domain name tied to the IP address. From here, we can add this IP/Domain combo to our etc/hosts file
DNS Zone Transfer (finding subdomains)
host -l <domain-name> <dns_server-address (target)>Example: host -l cronos.htb 10.10.10.13