content/projects/udfx.md (1803B)
1 +++
2 title = "udfx"
3 description = "Ultimate Domain Finder X. Pulls every DNS record out of Active Directory over LDAP."
4 weight = 40
5 date = 2026-02-06
6
7 [extra]
8 tier = "brief"
9
10 eyebrow = "Active Directory DNS · PowerShell"
11 tagline = "In an air-gapped Windows estate the DNS zone is the map, and Active Directory is already holding it. This asks for it directly."
12 lang = "PowerShell"
13 license = ""
14 version = ""
15 platform = "Windows"
16 repo = "https://github.com/sqzer-x/udfx"
17 stars = 0
18 accent = "#c2a06e"
19 mark = ""
20 logo = ""
21
22 actions = [
23 { label = "Source", url = "https://github.com/sqzer-x/udfx", style = "ghost" },
24 ]
25
26 facts = [
27 { value = "LDAP", label = "Method" },
28 { value = "5.1+", label = "PowerShell" },
29 { value = "Domain user", label = "Privileges" },
30 { value = "4", label = "Output files" },
31 ]
32
33 features_eyebrow = ""
34 features_title = ""
35 features_intro = ""
36 features = []
37
38 session_eyebrow = ""
39 session_title = ""
40 session_shell = ""
41 session_caption = ""
42 session_lines = []
43
44 cta_title = ""
45 cta_text = ""
46 cta_actions = []
47 +++
48
49 Every domain and subdomain registered in AD-integrated DNS, read over LDAP. No
50 internet, no extra service, and no administrator account — a plain domain user
51 is enough, which is the point: this is what an attacker who has one already
52 sees.
53
54 Each record comes out with its type (A, NS, CNAME, MX, SRV, TXT), its value, its
55 zone, and the root domain it belongs to, with zones sorted into primary,
56 subdomain and external. The run writes four files: the full record set as CSV,
57 JSON and text, plus a deduplicated list of root domains, which is usually the
58 one you actually open first.
59
60 ```powershell
61 .\Get-ADDnsRecords.ps1 -Domain corp.example.com
62 ```
63
64 Needs PowerShell 5.1 or newer on a domain-joined system.