Some Useful nslookup Commands

nslookup:

// SOA record
> set type=SOA
> targetdomain.com

// zone transfer
> server DnsServer // set default server
> ls -d targetdomain.com

// name servers
> set q=ns
> targetdomain.com

// host address
> set q=a
// for IPv6 records > set q=aaaa
> host.targetdomain.com

// reverse lookup
> set q=ptr
> host.targetdomain.com

// mail server
> set q=mx
> tragetdomain.com

// host info - don't employ them
> set q=hinfo
> targetdomain.com

// txt info
> set q=txt
> targetdomain.com

// services
> set q=srv
> targetdomain.com

// where services are located
> ls -t SRV targetdomain.com

// some useful commands
>_ldap._tcp.dc._msdcs
>_ldap._tcp.pdc._msdcs
>_ldap._tcp.gc._msdcs
>_kerberos._tcp.dc._msdcs
>_gc._tcp
>_ldap._tcp
>_kpasswd._tcp
>_kerberos._tcp

nslookup can only use the DNS (not NetBIOS) resolver to obtain info, but Ping can use all available methods.

References:

• The Hacker's Handbook: The Strategy Behind Breaking into and Defending Networks by Susan Young and Dave Aitel
• Assessing Network Security by Ben Smith, David LeBlanc, Kevin Lam