When a nameserver refuses zone transfers - which, these days, is most of them - subdomain brute forcing is how you enumerate a domain. dnsmap is the tool built for exactly that: point it at a domain and it grinds through a
dnsenum is the classic DNS enumeration tool - a multithreaded Perl script that has been in every pentester's kit for over a decade. Point it at a domain and it gathers the host address, the nameservers, the mail servers,
If you learn one DNS enumeration tool, make it dnsrecon. It is the Swiss Army knife of the category: a single, actively maintained Python script that pulls standard records, attempts zone transfers against every nameserver, enumerates SRV records, brute forces
IPv6 addresses look intimidating until you have seen enough real ones to recognize the patterns. The first hextet usually tells you everything: what kind of address it is and what it is for. This post is a worked reference - one
HSRP configuration is short - a working setup is two lines per router - but the short config hides the decisions that actually matter. Which router is active, whether it stays active after a reboot, and what happens when its uplink fails
There is no single "IPv6 migration button." Instead there are three transition mechanisms, and the skill is knowing which one to reach for in a given situation. Dual-stack, tunneling, and translation each solve a different shape of
Dual-stack and tunnels both assume IPv6 exists on both ends of a conversation. NAT64 solves the harder case: an IPv6-only client that must reach a server which only speaks IPv4. It does this by translating between the two
Sometimes you have IPv6 islands that need to talk to each other, but the network in between is IPv4-only and you cannot change it (a provider core, a legacy WAN, a merged network you do not fully control). The
IS-IS is the quietest way to break IPv6 in your network. It will happily form an adjacency, show every neighbor as up, and route IPv4 perfectly, while dropping your IPv6 traffic into a black hole on any link where
EIGRP did not just bolt IPv6 support onto the existing process. On Cisco IOS XE, EIGRP for IPv6 is a separate protocol instance with its own topology table, its own neighbors, and a configuration model that trips up engineers who
The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.