Find and submit the contents of the TXT record in Active Subomain enum

Hello, i’m trying to do the Active subdomain enumeration section in the module " Information Gathering - Web Edition " an there is this question : " Find and submit the contents of the TXT record in Active Subomain enum ". Actually i’m stuck if someone can help me or give me a hint, thank you :slight_smile:

1 Like

I have same the problem.

1 Like

Hey, were you able to complete the zone transfer on the target machine?
Did you get the answers to the first two questions?

Once you find all of the subdomains via transfer, then it is easy to query them for the answer.

DM me if this was not enough, or explain to me in greater detail where you are getting stuck.


Hello, I finished the module ( uh actually I need 1 more thing, it’s just counting how many A records there is ) but I was able to complete all the others questions, actually it was just à problem of understanding what a zone is, it was way easier after that haha, but thanks a lot ! ( if someone need help, I would be incredibly happy to help :slight_smile: )

1 Like

I can do it.

I’ve been able to do the zone transfer but I don’t think I’m doing the right thing when I query the subdomains because I don’t get anything. Can you give me a hint on how to query the subdomains?

Have you queried every subdomain? I nearly gave up before I found it haha. DM me the line you are using to query it.

1 Like

Did you use nslookup or dig I’m stuck. Did you use the subdomain with the IP address or the target IP?

I used dig for that module, nslookup kept giving me weird output. I think you need to query the dns server. You might need to do a transfer first. Its been a while.

How do you transfer?

Hey i think i’m using a wrong query. Can you give me a little hint? I’m using: dig txt inlanefreight.htb @<subdomain_ip_adress>

The subdomain ip i’m usign it’s from axfr output

Note: I solve this when I realize I didn’t know very well what is a zone. Footprinting module help me to solve the question

I don’t know how you get anything from AXFR output. I haven’t gotten any output at all using dig axfr at all no matter what subdomain I hit it with. Can you give me any assistance with this? I’m sure I’m missing something, but I’ve been over the material several times now and can’t seem to find what it might be.

1 Like

Never mind. I figured it out. It’s right in the lesson! I feel kind of stupid now for missing it.