description
DNS Enumeration workflow -- can we gain an increased attack surface?

DNS

Methodology

Web server running? Visit IP address in browser; does it give you a subdomain? If so, add to /etc/hosts
Attempt zone transfer
dnsrecon
subdomain enumeration
vhost enumeration