Stealth
Find all DCs in a domain quickly, less noise
nslookup -type=SRV _ldap._tcp.dc._msdcs.dhital.localFinding kerberos servers(DCs) usually
nslookup -type=SRV _kerberos._tcp.dhital.local
nslookup -type=SRV _kerberos._udp.dhital.localFind Global Catalogue Servers
nslookup -type=SRV _gc._tcp.domain.localFind LDAP servers
nslookup -type=SRV _ldap._tcp.dhital.localFind domain controllers for specific domain
nslookup -type=SRV _ldap._tcp.dc._msdcs.child.dhital.localLast updated