تخطَّ إلى المحتوى
1337skills 1337skills - أوراق الغش

DNSenum

Installation

Debian/Ubuntu

sudo apt-get update
sudo apt-get install dnsenum

Manual Installation

git clone https://github.com/fwaeytens/dnsenum.git
cd dnsenum
chmod +x dnsenum.pl
./dnsenum.pl --help

macOS

brew install dnsenum

From Source

# Requires Perl and dependencies
sudo cpan Net::DNS Net::NetAddr::IP Net::Whois::IP XML::Writer

Basic Usage

Simple Domain Enumeration

dnsenum example.com

Verbose Output

dnsenum -v example.com

Save Output to File

dnsenum example.com -o output.txt

XML Output

dnsenum example.com -o output.xml -x

DNS Record Enumeration

Standard DNS Queries

# Query A records (IPv4 addresses)
dnsenum example.com

# Query NS records (nameservers)
dnsenum --nsr example.com

# Query MX records (mail servers)
dnsenum --mx example.com

# Query SOA records
dnsenum --soa example.com

Specify Nameserver

# Query using specific nameserver
dnsenum example.com -s 8.8.8.8

# Query using multiple nameservers
dnsenum example.com -s 8.8.8.8 -s 1.1.1.1

Zone Transfer Attempts

Automatic Zone Transfer Detection

# DNSenum automatically attempts zone transfers
dnsenum example.com

Manual Zone Transfer Testing

# Test against specific nameserver
dnsenum example.com --nsr

# Verbose zone transfer attempts
dnsenum -v example.com

Successful Zone Transfer Extraction

# If zone transfer succeeds, all zone records are dumped
dnsenum example.com -o zonefile.txt

Subdomain Brute Forcing

Basic Brute Force

# Use default wordlist
dnsenum --enum example.com

# Shorter syntax
dnsenum -f example.com

Custom Wordlist

# Use custom subdomain wordlist
dnsenum --enum -f /path/to/wordlist.txt example.com

# Example wordlist locations
dnsenum -f /usr/share/wordlists/dnsmap.txt example.com
dnsenum -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt example.com

Brute Force with Threading

# Enable threading for faster enumeration
dnsenum --threads 16 example.com

# Combine with custom wordlist
dnsenum --threads 32 -f /path/to/wordlist.txt example.com

Filter Results

# Brute force with output filtering
dnsenum --enum example.com -o results.txt

Google Scraping for Subdomains

Enable Google Scraping

# Scrape Google for subdomains
dnsenum -g example.com

Combined Enumeration (Brute Force + Google)

# Use all enumeration methods
dnsenum --enum -g -f wordlist.txt example.com

# With threading
dnsenum --enum -g --threads 16 example.com

Google Results Limits

# Scrape Google with increased results (requires patience)
dnsenum -g example.com -o results.txt

WHOIS Queries

Domain WHOIS Information

# Retrieve WHOIS data
dnsenum --whois example.com

WHOIS with Full Output

# Detailed WHOIS information
dnsenum -v --whois example.com

IP WHOIS Lookups

# Get WHOIS for discovered IPs
dnsenum example.com | grep -i address

Threading and Performance

Single-Threaded (Default)

dnsenum example.com

Multi-Threaded Enumeration

# 8 threads
dnsenum --threads 8 example.com

# 16 threads (recommended)
dnsenum --threads 16 example.com

# 32 threads (aggressive)
dnsenum --threads 32 -f wordlist.txt example.com

Thread-Limited Brute Force

# Brute force with thread control
dnsenum --enum --threads 20 -f wordlist.txt example.com

Output Options

Text Output

# Save as text file
dnsenum example.com -o output.txt

XML Output

# Save as XML (detailed structure)
dnsenum example.com -o output.xml -x

Combined Output Formats

# Generate both text and XML
dnsenum example.com -o results.txt
dnsenum example.com -o results.xml -x

Console Output Control

# Verbose output to console
dnsenum -v example.com

# Standard output (less verbose)
dnsenum example.com

# Quiet mode (minimal output)
dnsenum example.com 2>/dev/null

Advanced Options

Specify Port

# Use non-standard DNS port
dnsenum example.com -s 8.8.8.8:5353

Delay Between Requests

# Add delay to avoid rate limiting (in milliseconds)
dnsenum --delay 100 example.com

Retrieve AXFR (Zone Transfer)

# Attempt AXFR from all nameservers
dnsenum --nsr example.com

Combined Advanced Enumeration

# Full enumeration with all methods
dnsenum \
  --enum \
  -f /usr/share/wordlists/subdomains.txt \
  --threads 16 \
  -g \
  --whois \
  -o results.txt \
  example.com

Complete Enumeration Examples

Beginner: Basic Domain Scan

dnsenum example.com -o scan_basic.txt

Intermediate: Brute Force with Wordlist

dnsenum \
  --enum \
  -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --threads 16 \
  example.com

Advanced: Full Reconnaissance

dnsenum \
  --enum \
  -f /usr/share/wordlists/dnsmap.txt \
  --threads 32 \
  -g \
  --whois \
  --nsr \
  -v \
  -o full_enum_$(date +%s).txt \
  -x \
  example.com

Quick Corporate Network Scan

dnsenum \
  --enum \
  --threads 20 \
  -f wordlist.txt \
  -g \
  example.com | tee -a enum_log.txt

DNS Records Explained

Record TypePurposeExample
AIPv4 addressexample.com → 93.184.216.34
AAAAIPv6 addressexample.com → 2606:2800:220:1:248:1893:25c8:1946
CNAMECanonical name (alias)www.example.com → example.com
MXMail server prioritymail.example.com (priority 10)
NSNameserverns1.example.com
SOAStart of AuthorityPrimary nameserver info
TXTText records (SPF, DKIM)v=spf1 include:_spf.google.com
SRVService records_sip._tcp.example.com

Common Wordlists

Built-in/Recommended Wordlists

# SecLists (comprehensive)
/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# DNSMap wordlist
/usr/share/wordlists/dnsmap.txt

# Common subdomains
/usr/share/wordlists/amass/subdomains.txt

Download Wordlists

# Clone SecLists
git clone https://github.com/danielmiessler/SecLists.git

# Use specific wordlist
dnsenum -f SecLists/Discovery/DNS/subdomains-top1million-5000.txt example.com

DNSenum vs Similar Tools

FeatureDNSenumdnsrecondignslookup
Zone TransferYesYesYesNo
Subdomain Brute ForceYesYesNoNo
Google ScrapingYesNoNoNo
Multi-threadingYesNoNoNo
WHOIS LookupYesNoNoNo
XML OutputYesYesNoNo
Learning CurveEasyMediumMediumEasy
SpeedFastMediumVery FastVery Fast

Troubleshooting

Permission Denied

# Make script executable
chmod +x dnsenum.pl
./dnsenum.pl example.com

Missing Perl Modules

# Install required Perl modules
sudo cpan Net::DNS
sudo cpan Net::NetAddr::IP
sudo cpan Net::Whois::IP
sudo cpan XML::Writer

DNS Server Not Responding

# Verify DNS connectivity
nslookup example.com 8.8.8.8

# Try alternative nameserver
dnsenum -s 1.1.1.1 example.com

Rate Limiting

# Add delay between requests
dnsenum --delay 500 example.com

# Reduce threading
dnsenum --threads 4 example.com

No Results Found

# Verify domain validity
dnsenum google.com

# Check with verbose output
dnsenum -v example.com

# Try specific nameserver
dnsenum -s 8.8.8.8 example.com
  • Obtain written permission before enumerating any domain you don’t own
  • DNS enumeration may trigger intrusion detection systems
  • Use during authorized penetration tests only
  • Respect rate limiting to avoid denial of service
  • Check local laws regarding network reconnaissance activities

Tips and Best Practices

  1. Start with zone transfer attempts — fastest method if successful
  2. Use Google scraping for quick results — complements brute forcing
  3. Customize wordlists — add company-specific naming conventions
  4. Save output — enables comparative analysis over time
  5. Combine tools — use with dnsrecon or Amass for comprehensive mapping
  6. Monitor resources — high threading can consume bandwidth
  7. Verify findings — cross-check results with alternative tools