|DNSENUM(1)||User Contributed Perl Documentation||DNSENUM(1)|
dnsenum -- multithread script to enumerate information on a domain and to discover non-contiguous IP blocks
dnsenum version 1.2.6
dnsenum [options] <domain> -f dns.txt
Supported operations: nslookup, zonetransfer, google scraping, domain brute force (support also recursion), whois ip and reverse lookups.
- 1) Get the host's address (A record).
- 2) Get the nameservers (threaded).
- 3) Get the MX record (threaded).
- 4) Perform AXFR queries on nameservers (threaded).
- 5) Get extra names and subdomains via google scraping (google query = "allinurl: -www site:domain").
- 6) Brute force subdomains from (REQUIRED), can also perform recursion on subdomain that have NS records (all threaded).
- 7) Calculate Class C IP network ranges from the results and perform whois queries on them (threaded).
- 8) Perform reverse lookups on netranges (class C or/and whois netranges)(threaded).
- 9) Write to domain_ips.txt file non-contiguous ip-blocks results.
The brute force -f switch takes priority over default dns.txt
- --dnsserver <server>
- Use this DNS server to perform all A, NS and MX queries,
the AXFR and PTR queries are sent to the domain's NS servers.
- Shortcut option equivalent to --threads 5 -s 20 -w.
- -h, --help
- Print the help message.
- Skip the reverse lookup operations.
Reverse lookups can take long time on big netranges.
- Disable ANSIColor output.
This option is only intended to be used on consoles that do not support
- Show and save private ips at the end of the file domain_ips.txt.
- --subfile <file>
- Write all valid subdomains to this file.
Subdomains are taken from NS and MX records, zonetransfer,
google scraping, brute force and reverse lookup hostnames.
- -t, --timeout <value>
- The tcp and udp timeout values in seconds (default: 10s).
- --threads <va>
- The number of threads that will perform different queries.
- -v, --verbose
- Be verbose (show all the progress and all the error messages).
GOOGLE SCRAPING OPTIONS:¶
BRUTE FORCE OPTIONS:¶
-u g Update using only google scraping results.
-u r Update using only reverse lookup results.
-u z Update using only zonetransfer results.
- -r, --recursion
- Recursion on subdomains, brute force all discovered subdomains
that have an NS record.
WHOIS IP OPTIONS:¶
Perform whois ip queries on c class netanges discovered from previous operations.
- -d, --delay <value>
- The maximum value of seconds to wait between whois queries,
the value is defined randomly, (default: 3s).
- -w, --whois
- Perform the whois queries on c class network ranges.
Warning: this can generate very large netranges and it
will take lot of time to perform reverse lookups.
REVERSE LOOKUP OPTIONS:¶
- -e, --exclude <regexp>
- Exclude PTR records that match the regexp expression from reverse
lookup results, useful on invalid hostnames.
Final non-contiguous ip blocks are written to domain_ips.txt file.
NOTES: Final non-contiguous ip blocks are calculated :
- 1) From reverse lookups that were performed on netranges ( c class network ranges or whois netranges ).
- 2) If the noreverse switch is used then they are calculated from previous operations results (nslookups, zonetransfers, google scraping and brute forcing).
dnsenum: multithread script to enumerate information on a domain and to discover non-contiguous ip blocks.
Modules that are included in perl 5.10.0:
Getopt::Long, IO::File, Thread::Queue.
Other Necessary modules:
Must have: Net::DNS, Net::IP, Net::Netmask.
Optional: Net::Whois::IP, HTML::Parser, WWW::Mechanize.
Perl ithreads modules (perl must be compiled with ithreads
Filip Waeytens <filip.waeytens[at]gmail.com>
tix tixxDZ <tixxdz[at]gmail.com>
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.