DNS - 53

Zone Transfer

If port 53 is open, conduct DNS reconaissance (i.e. zone transfer attack dig axfr test.htb @IP_of_target to broaden attack surface and append new findings to /etc/hosts