I want to identify subdomains of a target domain during a security assessment. What command-line tools or techniques, such as dig, host, or nslookup, can I use for DNS enumeration? Are there specific DNS records or query types I should focus on to gather subdomain information effectively?
Practical examples of these commands would be helpful.