Fast subdomains enumeration tool for penetration testers
Dnscan is a python wordlist-based DNS subdomain scanner
A DNS meta-query spider that enumerates DNS records, and subdomains.
Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It's really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require that you already know what IP space you are looking for. This does not perform exploitation and does not scan the whole internet indiscriminately. It is meant specifically to locate likely targets both inside and outside a corporate network. Because it uses DNS primarily you will often find mis-configured networks that leak internal address space. That's especially useful in targeted malware.
$ pip3 install fierce
$ fierce -h
Anubis is a subdomain enumeration and information gathering tool. Anubis collates data from a variety of sources, including HackerTarget, DNSDumpster, x509 certs, VirusTotal, Google, Pkey, and NetCraft. Anubis also has a sister project, AnubisDB, which serves as a centralized repository of subdomains.
Prerequisites
If you are Linux user, the following modules or libraries are also required:
sudo apt-get install python3-pip python-dev libssl-dev libffi-dev
pip3 install anubis-netsec
snap install anubis
Nmap can Attempts to enumerate DNS hostnames by brute force guessing of common subdomains. With the dns-brute.srv argument, dns-brute will also try to enumerate common DNS SRV records. Wildcard records are listed as "*A" and "*AAAA" for IPv4 and IPv6 respectively.
The dns-brute module of nmap request the following.
Lepus is a utility for identifying and collecting subdomains for a given domain. Subdomain discovery is a crucial part during the reconnaissance phase. One of the strength of Lepus lies at Performing several checks on identified domains for potential subdomain-takeover vulnerabilities. The module is enabled with --takeover and is executed after all others. If such a vulnerability is identified, the results are printed in the output and in a .csv file in the respective project folder under the directory with the results. Checks are performed for the following services. Lepus performs the following. Services (Collecting subdomains from the below services) Dictionary mode for identifying domains (optional) Permutations on discovered subdomains (optional) Reverse DNS lookups on identified public IPs (optional)
