dnstwist
Installation
Section intitulée « Installation »From PyPI
Section intitulée « From PyPI »pip install dnstwistFrom Source
Section intitulée « From Source »git clone https://github.com/elceef/dnstwist.git
cd dnstwist
pip install -e .docker run -it elceef/dnstwist dnstwist example.comRequirements
Section intitulée « Requirements »- Python 3.7+
dnspython— DNS resolutionrequests— HTTP requestsurllib3— URL parsingGeoIP2database (optional, for geolocation)
Basic Usage
Section intitulée « Basic Usage »Simple Permutation Check
Section intitulée « Simple Permutation Check »dnstwist example.comCheck and Resolve DNS
Section intitulée « Check and Resolve DNS »dnstwist -r example.comExtended Output with Registered Domains
Section intitulée « Extended Output with Registered Domains »dnstwist -r --registered example.comVerbose Mode
Section intitulée « Verbose Mode »dnstwist -v example.comPermutation Types
Section intitulée « Permutation Types »Bitsquatting
Section intitulée « Bitsquatting »Domain names differing by single bit flip in DNS wire format.
dnstwist --bitsquatting example.comHomoglyph Attack
Section intitulée « Homoglyph Attack »Visually similar characters (e.g., rn → m, 0 → O).
dnstwist --homoglyph example.comInsertion
Section intitulée « Insertion »Add characters within domain name.
dnstwist --insertion example.comOmission
Section intitulée « Omission »Remove single characters from domain.
dnstwist --omission example.comRepetition
Section intitulée « Repetition »Double consecutive characters.
dnstwist --repetition example.comReplacement
Section intitulée « Replacement »Replace characters with similar ones.
dnstwist --replacement example.comTransposition
Section intitulée « Transposition »Swap adjacent characters.
dnstwist --transposition example.comVowel Swap
Section intitulée « Vowel Swap »Replace vowels with other vowels.
dnstwist --vowelswap example.comAddition
Section intitulée « Addition »Add common TLD variations and prefixes/suffixes.
dnstwist --addition example.comHyphenation
Section intitulée « Hyphenation »Add hyphens at various positions.
dnstwist --hyphenation example.comAll Permutation Types
Section intitulée « All Permutation Types »dnstwist -a example.comDNS Resolution
Section intitulée « DNS Resolution »Resolve A Records
Section intitulée « Resolve A Records »dnstwist -r example.comResolve AAAA Records (IPv6)
Section intitulée « Resolve AAAA Records (IPv6) »dnstwist -r --aaaa example.comResolve with Specific Nameserver
Section intitulée « Resolve with Specific Nameserver »dnstwist -r -ns 8.8.8.8 example.comCheck Registration Status
Section intitulée « Check Registration Status »dnstwist --registered example.comVerify DNSSEC
Section intitulée « Verify DNSSEC »dnstwist -r --dnssec example.comMX Record Checking
Section intitulée « MX Record Checking »Detect MX Records
Section intitulée « Detect MX Records »dnstwist -r example.com | grep MXFull MX Verification
Section intitulée « Full MX Verification »dnstwist -r --mx example.comMail Server Analysis
Section intitulée « Mail Server Analysis »dnstwist -r -mx example.com | head -20GeoIP Lookup
Section intitulée « GeoIP Lookup »Enable GeoIP Resolution
Section intitulée « Enable GeoIP Resolution »dnstwist -r --geoip example.comDownload GeoIP2 Database
Section intitulée « Download GeoIP2 Database »# Requires MaxMind account
curl https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-City&license_key=YOUR_KEY&suffix=tar.gz -o geolite2.tar.gz
tar xzf geolite2.tar.gzUse Custom GeoIP Database
Section intitulée « Use Custom GeoIP Database »dnstwist -r --geoip --db /path/to/GeoLite2-City.mmdb example.comWeb Page Similarity Detection
Section intitulée « Web Page Similarity Detection »Fuzzy Hash Comparison
Section intitulée « Fuzzy Hash Comparison »dnstwist -r --ssdeep example.comDetect Phishing Pages
Section intitulée « Detect Phishing Pages »dnstwist -r --ssdeep --verify example.comHTTP Banner Grabbing
Section intitulée « HTTP Banner Grabbing »dnstwist -r --http example.comHTTPS Certificate Analysis
Section intitulée « HTTPS Certificate Analysis »dnstwist -r --cert example.comOutput Formats
Section intitulée « Output Formats »CSV Output
Section intitulée « CSV Output »dnstwist -r --csv example.com > results.csvJSON Output
Section intitulée « JSON Output »dnstwist -r --json example.com > results.jsonList Format (Default)
Section intitulée « List Format (Default) »dnstwist -r example.com > results.txtDomain Names Only
Section intitulée « Domain Names Only »dnstwist example.com | cut -d' ' -f1Registered Domains Only
Section intitulée « Registered Domains Only »dnstwist -r example.com | grep -E "^[a-z].*\[" | cut -d' ' -f1Dictionary-Based Generation
Section intitulée « Dictionary-Based Generation »Add Dictionary Words
Section intitulée « Add Dictionary Words »dnstwist -w /path/to/wordlist.txt example.comGenerate with Common Dictionary
Section intitulée « Generate with Common Dictionary »dnstwist -w /usr/share/dict/words example.comDictionary-Only Mode
Section intitulée « Dictionary-Only Mode »dnstwist -w wordlist.txt --dictionary-only example.comWordlist Format
Section intitulée « Wordlist Format »# One word per line
malware
phishing
security
adminCombine with Permutations
Section intitulée « Combine with Permutations »dnstwist -w wordlist.txt -a example.comWHOIS Lookups
Section intitulée « WHOIS Lookups »Basic WHOIS Query
Section intitulée « Basic WHOIS Query »dnstwist -r example.com | grep WHOISRegistrar Information
Section intitulée « Registrar Information »whois examplee.comBulk WHOIS Batch
Section intitulée « Bulk WHOIS Batch »dnstwist -r --whois example.comMonitoring and Automation
Section intitulée « Monitoring and Automation »Run Periodic Checks (Bash Loop)
Section intitulée « Run Periodic Checks (Bash Loop) »while true; do
dnstwist -r --json example.com > check_$(date +%s).json
sleep 3600 # Check hourly
doneContinuous Monitoring with cron
Section intitulée « Continuous Monitoring with cron »# Add to crontab -e
0 * * * * /usr/local/bin/dnstwist -r --json example.com >> /var/log/dnstwist.logReal-Time Monitoring Script
Section intitulée « Real-Time Monitoring Script »#!/bin/bash
domain="example.com"
baseline=$(dnstwist -r --json "$domain")
while true; do
current=$(dnstwist -r --json "$domain")
if [ "$baseline" != "$current" ]; then
echo "Change detected at $(date)" | mail -s "dnstwist Alert" admin@example.com
baseline="$current"
fi
sleep 300
doneLog Results to Database
Section intitulée « Log Results to Database »dnstwist -r --json example.com | jq . | sqlite3 dnstwist.dbAPI and CI Integration
Section intitulée « API and CI Integration »JSON API Output for Integration
Section intitulée « JSON API Output for Integration »dnstwist -r --json example.com | jq '.[] | select(.dns_a != null)'Parse JSON Results
Section intitulée « Parse JSON Results »dnstwist -r --json example.com | jq '.[] | {domain, dns_a, dns_aaaa, whois_created}'Filter Registered Domains
Section intitulée « Filter Registered Domains »dnstwist -r --json example.com | jq '.[] | select(.dns_a != null) | .domain'GitHub Actions Integration
Section intitulée « GitHub Actions Integration »name: dnstwist Security Check
on: [schedule]
jobs:
dnstwist:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@v2
- run: pip install dnstwist
- run: dnstwist -r --json example.com > results.json
- uses: actions/upload-artifact@v2
with:
name: dnstwist-results
path: results.jsonGitLab CI Integration
Section intitulée « GitLab CI Integration »dnstwist_scan:
image: python:3.9
script:
- pip install dnstwist
- dnstwist -r --json example.com > results.json
artifacts:
paths:
- results.jsonJenkins Pipeline
Section intitulée « Jenkins Pipeline »pipeline {
stages {
stage('dnstwist Scan') {
steps {
sh 'pip install dnstwist'
sh 'dnstwist -r --json example.com > results.json'
archiveArtifacts artifacts: 'results.json'
}
}
}
}Advanced Options
Section intitulée « Advanced Options »Custom Threads for Parallel Resolution
Section intitulée « Custom Threads for Parallel Resolution »dnstwist -r --threads 10 example.comSet DNS Query Timeout
Section intitulée « Set DNS Query Timeout »dnstwist -r --timeout 2 example.comName Server Configuration
Section intitulée « Name Server Configuration »dnstwist -r -ns 1.1.1.1 example.comDisable DNSSEC Validation
Section intitulée « Disable DNSSEC Validation »dnstwist -r --no-dnssec example.comQuiet Mode (Minimal Output)
Section intitulée « Quiet Mode (Minimal Output) »dnstwist -q example.comTypical Workflows
Section intitulée « Typical Workflows »Complete Phishing Investigation
Section intitulée « Complete Phishing Investigation »dnstwist -r -a --ssdeep --geoip --json example.com > investigation.jsonMonitor High-Risk Domains
Section intitulée « Monitor High-Risk Domains »for domain in company.com company.org company.net; do
echo "=== $domain ==="
dnstwist -r --registered "$domain"
doneGenerate Squatting Report
Section intitulée « Generate Squatting Report »dnstwist -r --csv -a example.com > squatting_report.csv
# Then import into spreadsheet for analysisCheck Permutations Without Resolution
Section intitulée « Check Permutations Without Resolution »dnstwist example.com | wc -l # Total permutations
dnstwist example.com # List all potential domainsFind Only Suspicious Registrations
Section intitulée « Find Only Suspicious Registrations »dnstwist -r example.com | grep -E "\[A\]|\[MX\]" | grep -v "$(dig +short example.com)"Performance Tips
Section intitulée « Performance Tips »- Reduce Threads for API Rate Limits:
--threads 2on restricted networks - Skip DNS Verification: Remove
-rflag for faster enumeration - Filter by Permutation Type: Use specific flags instead of
-ato reduce output - Export to CSV Early: Process data in spreadsheet tools rather than terminal
- Batch Multiple Domains: Create script to iterate and append to single JSON
Common Issues
Section intitulée « Common Issues »DNS Timeout
Section intitulée « DNS Timeout »# Increase timeout value
dnstwist -r --timeout 5 example.comRate Limiting
Section intitulée « Rate Limiting »# Add delay between requests
dnstwist -r --threads 1 example.comGeoIP Database Not Found
Section intitulée « GeoIP Database Not Found »# Ensure database is in expected location
dnstwist -r --geoip --db ~/GeoLite2-City.mmdb example.comMemory Usage with Large Wordlists
Section intitulée « Memory Usage with Large Wordlists »# Process in chunks instead
split -l 1000 wordlist.txt chunk_
for chunk in chunk_*; do
dnstwist -w "$chunk" example.com
doneSecurity Best Practices
Section intitulée « Security Best Practices »- Responsible Disclosure: Only test domains you own or have authorization for
- Rate Limiting: Respect DNS provider rate limits and ISP policies
- Logging: Enable verbose mode during investigations for audit trails
- Automation Consent: Inform stakeholders of automated monitoring
- Data Privacy: Securely store results containing sensitive information
- Legal Compliance: Verify domain monitoring is within acceptable use policies