bloodyAD get dnsDump
Dump every AD-integrated DNS record from the domain. Authenticated users can read most zones by default — useful for finding internal hostnames, CNAMEs, and stale records to spoof.
- Tool
- bloodyAD
- Category
- Enumeration / LDAP
- Platform
- linux
- Requires
- password
- Protocols
- LDAP, DNS
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' get dnsDumpExamples
bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' get dnsDumpTags
Related commands
- BloodHound AD Collection Collect Active Directory data for BloodHound analysis
- bloodyAD get children List the immediate children of a container or OU. Handy for walking the directory tree…
- bloodyAD get membership Recursively resolve every group a principal belongs to, including nested groups. Faster…
- bloodyAD Get Object Attributes Read all (or specific) LDAP attributes of an AD object. Useful for confirming…
- bloodyAD get search Run an arbitrary LDAP filter against the directory and pull selected attributes. The…
- bloodyAD get trusts Enumerate domain and forest trust relationships, including direction, type, and trust…
- bloodyAD get writable Enumerate every AD object the current principal can write to — fastest path to finding…
- Impacket findDelegation Find all accounts with delegation rights (unconstrained, constrained, RBCD)