DMitry (Deepmagic Information Gathering Tool) is a comprehensive reconnaissance tool that automates information gathering during the reconnaissance phase of penetration testing. It combines multiple data collection techniques into a single command-line utility, making it ideal for initial OSINT investigations and target profiling.
sudo apt-get update
sudo apt-get install dmitry
wget http://www.deepmagic.com/dmitry/dmitry-1.3.3.tar.gz
tar -xzf dmitry-1.3.3.tar.gz
cd dmitry-1.3.3
./configure
make
sudo make install
dmitry -v
| Command | Description |
|---|
dmitry [options] target | Primary syntax for running dmitry |
dmitry -h | Display help menu |
dmitry -v | Show version information |
target | Domain name, IP address, or hostname |
WHOIS queries retrieve registrar and registrant information for domain names and IP addresses.
dmitry -w example.com
dmitry -w 192.0.2.1
dmitry -w example.com > whois_results.txt
dmitry -w example.com -o whois_output.txt
dmitry -w -v example.com
| Flag | Function |
|---|
-w | Perform WHOIS lookup on target |
-o filename | Write output to specified file |
-v | Verbose output with additional details |
Subdomain enumeration identifies additional subdomains associated with the target domain through various DNS techniques and database queries.
dmitry -s example.com
dmitry -s -v example.com
dmitry -s example.com -o subdomains.txt
dmitry -s example.com > subdomains1.txt
dmitry -s example.net > subdomains2.txt
| Flag | Function |
|---|
-s | Perform subdomain search on target |
-o filename | Save results to file |
-v | Verbose mode with detailed enumeration info |
Email harvesting extracts email addresses associated with the target domain from public sources and search indexes.
dmitry -e example.com
dmitry -e -v example.com
dmitry -e example.com -o emails.txt
dmitry -e example.com | grep "@example.com"
dmitry -e example.com | sort | uniq
| Flag | Function |
|---|
-e | Perform email harvesting on target |
-o filename | Output results to file |
-v | Verbose output with source information |
TCP port scanning identifies open ports and services running on the target system, providing service identification and availability information.
dmitry -p example.com
dmitry -p example.com
dmitry -p -v example.com
dmitry -p example.com
dmitry -p example.com 2>&1 | head -20
| Flag | Function |
|---|
-p | Perform TCP port scan on target |
-v | Show service names and additional details |
-o filename | Save scan results to file |
OS fingerprinting analyzes network responses and system characteristics to determine the target operating system and version.
dmitry -f example.com
dmitry -f -v example.com
dmitry -f example.com -o fingerprint.txt
| Flag | Function |
|---|
-f | Perform OS fingerprinting on target |
-v | Verbose output with detailed analysis |
-o filename | Write fingerprint results to file |
Dmitry’s power comes from combining multiple reconnaissance techniques in a single command, creating comprehensive target profiles.
dmitry -w -s -e -p -f example.com
dmitry -w -s -e -p -f -v example.com
dmitry -w -s -e -p -f -v example.com -o target_profile.txt
dmitry -w -s -e -p -f -v example.com -o target_report.txt 2>&1
for domain in example.com example.net example.org; do
dmitry -w -s -e -p -f -v $domain -o ${domain}_report.txt
done
| Combination | Purpose |
|---|
-w -s | WHOIS + Subdomain enumeration |
-s -e | Subdomain + Email discovery |
-p -f | Port scanning + OS fingerprinting |
-w -s -e -p -f | Complete reconnaissance profile |
dmitry -w -s -e -p -f example.com >> reconnaissance.txt
dmitry -w -s -e -p -f -v example.com -o dmitry_$(date +%Y%m%d_%H%M%S).txt
mkdir -p dmitry_results
dmitry -w -s -e -p -f -v example.com -o dmitry_results/example.com_report.txt
dmitry -s example.com | tee subdomains.txt | sort | uniq
# Quick WHOIS and subdomain check
dmitry -w -s example.com
# Complete information gathering
dmitry -w -s -e -p -f -v example.com -o target_complete_recon.txt
# Create target list and run dmitry on each
cat targets.txt | while read target; do
echo "[*] Gathering information on $target..."
dmitry -w -s -e -p -f -v $target -o results/${target}_full.txt
sleep 2 # Rate limiting
done
# Extract all emails for phishing awareness training
dmitry -e example.com | sort | uniq > employee_emails.txt
| Flag | Description |
|---|
-w | WHOIS lookup |
-s | Subdomain enumeration |
-e | Email harvesting |
-p | TCP port scanning |
-f | OS fingerprinting |
-v | Verbose output |
-o filename | Output to file |
-i | Display IP address of target |
-t num | Specify timeout value (seconds) |
-h | Help menu |
-v | Version information |
dmitry -w example.com
# Review WHOIS registrant data
# Identify administrative contacts
# Note DNS server information
dmitry -p example.com
# Map open ports
# Identify running services
# Note version information
dmitry -e example.com
# Compile email addresses
# Identify department patterns
# Note naming conventions
- Registrar: Organization handling domain registration
- Registrant: Domain owner details
- Administrative Contact: Primary domain administrator
- Name Servers: DNS infrastructure
- Registration/Expiration: Domain timeline
- Valid Subdomains: Confirmed subdomains with DNS records
- Potential Hosts: Possible subdomains requiring verification
- Service Subdomains: Mail servers, FTP, web services
- Domain-based: Emails from primary domain
- Subdomain-based: Emails from identified subdomains
- Admin Addresses: Standard administrative emails (admin@, info@)
- Open Ports: Service ports accepting connections
- Filtered Ports: Ports behind firewall/filtering
- Closed Ports: Ports with active rejections
- Service Names: Identified services on ports
- Operating System: Identified OS and version
- System Uptime: Estimated system runtime
- Running Services: Detected services and versions
- Rate Limiting: Add delays between scans to avoid detection and server overload
- Legal Compliance: Ensure proper authorization before scanning
- Result Organization: Use timestamped output files for tracking changes
- Target Validation: Verify DNS resolution before running scans
- Information Correlation: Cross-reference results across all modules for accuracy
- Iterative Scanning: Perform repeated scans to discover new subdomains and services
- Note Taking: Document all findings for later analysis and correlation
dmitry -t 30 example.com # Increase timeout to 30 seconds
dmitry -i example.com # Display IP address information
nslookup example.com # Verify DNS resolution
dmitry -v example.com # Use verbose mode for debugging
# Verify target is accessible and valid
# Check network connectivity
# Add delays between commands
for domain in $(cat domains.txt); do
dmitry -w -s $domain
sleep 5
done
- nmap — Advanced port scanning and OS detection
- whois — Standalone WHOIS query tool
- dig/nslookup — DNS query utilities
- theHarvester — Email and subdomain harvesting
- Shodan — Internet-wide device search engine
