dnsmap(1) | scan for subdomains using bruteforcing techniques | dnsmap(1) |
dnsmap - scan for subdomains using bruteforcing techniques
dnsmap <target-domain> [options]
dnsmap scans a domain for common subdomains using a built-in or an external wordlist (if specified with -w option). The internal wordlist has around 1000 words in English and Spanish as ns1, firewall, servicios and smtp. So will be possible search for smtp.example.com inside example.com automatically. Results can be saved in CSV and human-readable format for further processing. dnsmap does NOT require root privileges to be run, and should NOT be run with such privileges for security reasons.
dnsmap was originally released back in 2006 and was inspired by the fictional story "The Thief No One Saw" by Paul Craig, which can be found in the book "Stealing the Network - How to 0wn the Box".
dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would typically discover the target company's IP netblocks, domain names, phone numbers, etc.
Subdomain bruteforcing is another technique that should be used in the enumeration stage, as it's especially useful when other domain enumeration techniques such as zone transfers don't work (is rare to see zone transfers being publicly allowed these days by the way).
Fun things that can happen:
The built-in wordlist is defined in src/dnsmap.h file. If needed, see the file to know all words.
Subdomain bruteforcing using dnsmap's built-in wordlist:
Subdomain bruteforcing using a user-supplied wordlist:
$ dnsmap example.com
Subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/ :
$ dnsmap example.com -w wordlist.txt
Example of subdomain bruteforcing using the built-in wordlist, saving the results to /tmp/, and waiting a random maximum of 300 milliseconds between each request:
$ dnsmap example.com -r /tmp
Subdomain bruteforcing with 0.8 seconds delay, saving results in regular and CSV format, filtering 2 user-provided IP and using a user-supplied wordlist:
$ dnsmap example.com -r /tmp/ -d 300
$ dnsmap example.com -d 800 -r /tmp/ -c /tmp/ -i 10.55.206.154,10.55.24.100 -w ./wordlist_TLAs.txt
Currently, dnsmap does not yet support parallel scanning and hence take quite a long time.
New bugs should be reported at https://github.com/resurrecting-open-source-projects/dnsmap/issues
dnsmap was originally written by "pagvac" in 2006. Currently it is maintained by volunteers, inside dnsmap project, at https://github.com/resurrecting-open-source-projects/dnsmap/
This manpage was written by Joao Eriberto Mota Filho.
25 Feb 2021 | dnsmap-0.36 |