Fierce
Overview
Section titled “Overview”Fierce is a semi-lightweight DNS reconnaissance tool designed to locate non-contiguous IP space and hostnames against specified domains. Originally written in Perl, it’s now available as a Python-based tool. It’s effective for initial reconnaissance, identifying additional networks connected to your target, and discovering hosts that may be misconfigured or forgotten.
Installation
Section titled “Installation”Pip (Recommended)
Section titled “Pip (Recommended)”pip install fierceKali Linux
Section titled “Kali Linux”sudo apt update
sudo apt install fierceFrom Source
Section titled “From Source”git clone https://github.com/mschwager/fierce.git
cd fierce
pip install -e .Docker
Section titled “Docker”docker run -it mschwager/fierce:latest fierce --helpBasic Usage
Section titled “Basic Usage”Simple Domain Scan
Section titled “Simple Domain Scan”fierce --domain example.comSpecify Output File
Section titled “Specify Output File”fierce --domain example.com --output results.txtJSON Output
Section titled “JSON Output”fierce --domain example.com --output results.json --format jsonZone Transfer Attempts
Section titled “Zone Transfer Attempts”Fierce attempts zone transfers by default, which can reveal entire DNS records if misconfigured:
# Zone transfers are included in basic scan
fierce --domain example.com
# Zone transfers are tried against discovered nameservers
# Results show all A records if transfer succeedsSubdomain Brute Forcing
Section titled “Subdomain Brute Forcing”Default Wordlist Brute Force
Section titled “Default Wordlist Brute Force”# Uses built-in default wordlist (140+ common subdomains)
fierce --domain example.comCustom Wordlist
Section titled “Custom Wordlist”fierce --domain example.com --wordlist /path/to/wordlist.txtLarge Wordlist (SecLists)
Section titled “Large Wordlist (SecLists)”fierce --domain example.com --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txtDNS Wildcard Filtering
Section titled “DNS Wildcard Filtering”# Fierce automatically detects DNS wildcards to reduce false positives
fierce --domain example.comDNS Server Specification
Section titled “DNS Server Specification”Query Specific Nameserver
Section titled “Query Specific Nameserver”fierce --domain example.com --nameserver 8.8.8.8Use Multiple Nameservers
Section titled “Use Multiple Nameservers”# Fierce queries all discovered nameservers by default
fierce --domain example.comPublic DNS Servers
Section titled “Public DNS Servers”# Google
fierce --domain example.com --nameserver 8.8.8.8
# Cloudflare
fierce --domain example.com --nameserver 1.1.1.1
# OpenDNS
fierce --domain example.com --nameserver 208.67.222.222Reverse DNS Lookups
Section titled “Reverse DNS Lookups”Reverse Lookup Range
Section titled “Reverse Lookup Range”# Find hostnames in IP range
fierce --domain example.com --range 192.168.1.0/24Reverse Lookups After Finding IPs
Section titled “Reverse Lookups After Finding IPs”# Fierce performs reverse lookups on discovered IPs automatically
fierce --domain example.comManual Reverse Range Scan
Section titled “Manual Reverse Range Scan”fierce --domain example.com --range 10.0.0.0/8Wide Scanning
Section titled “Wide Scanning”Find Nearby/Adjacent Networks
Section titled “Find Nearby/Adjacent Networks”# Looks for nearby IP ranges connected to target
fierce --domain example.comExtended IP Range Scanning
Section titled “Extended IP Range Scanning”# Scan broader range to find non-contiguous space
fierce --domain example.com --range 192.168.0.0/16Threading & Performance
Section titled “Threading & Performance”Increase Threads (Faster Scanning)
Section titled “Increase Threads (Faster Scanning)”# Default is 1 (slow), increase for faster results
fierce --domain example.com --threads 10Balanced Performance
Section titled “Balanced Performance”fierce --domain example.com --threads 5Aggressive Threading (Resource Intensive)
Section titled “Aggressive Threading (Resource Intensive)”fierce --domain example.com --threads 50Output Options
Section titled “Output Options”Text Output (Default)
Section titled “Text Output (Default)”fierce --domain example.com --output results.txtJSON Format
Section titled “JSON Format”fierce --domain example.com --format json --output results.jsonCSV Format
Section titled “CSV Format”fierce --domain example.com --format csv --output results.csvStandard Output (No File)
Section titled “Standard Output (No File)”fierce --domain example.comAdvanced Options
Section titled “Advanced Options”Full Domain List With Records
Section titled “Full Domain List With Records”fierce --domain example.com --fullDelay Between Requests
Section titled “Delay Between Requests”# Add delay to avoid detection/blocking (milliseconds)
fierce --domain example.com --delay 500Timeout for Requests
Section titled “Timeout for Requests”fierce --domain example.com --timeout 5Verbosity/Debug Mode
Section titled “Verbosity/Debug Mode”fierce --domain example.com --verboseCommon Recon Workflows
Section titled “Common Recon Workflows”Initial Corporate Network Mapping
Section titled “Initial Corporate Network Mapping”# Basic scan to identify primary infrastructure
fierce --domain example.com --output initial_recon.txt
# Then expand to adjacent ranges
fierce --domain example.com --range 10.0.0.0/8 --threads 5Complete Subdomain Enumeration
Section titled “Complete Subdomain Enumeration”# With custom wordlist for better coverage
fierce --domain example.com \
--wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
--threads 10 \
--format json \
--output subdomains.jsonNetwork Boundary Discovery
Section titled “Network Boundary Discovery”# Find non-contiguous spaces
fierce --domain example.com \
--range 192.168.0.0/16 \
--threads 5 \
--delay 200Integration With Other Tools
Section titled “Integration With Other Tools”# Output to feed into other reconnaissance tools
fierce --domain example.com --format csv --output hosts.csv
# Extract IPs for further scanning
fierce --domain example.com | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' | sort -u > ips.txtComparison With Similar Tools
Section titled “Comparison With Similar Tools”| Tool | Strengths | Use Case |
|---|---|---|
| Fierce | Fast, simple, zone transfers, adjacent IP finding | Quick recon, non-contiguous space discovery |
| DNSRecon | More options, DNSSEC checks, Google dorking | Comprehensive DNS analysis |
| DNSenum | Zone transfer, reverse lookups, subdomain enum | Detailed DNS mapping |
| Subfinder | Fast, passive sources, multiple APIs | Passive subdomain collection |
| Amass | Advanced, data aggregation, API integration | Enterprise-grade discovery |
DNS Zone Transfer Exploitation
Section titled “DNS Zone Transfer Exploitation”Understand Zone Transfer Security
Section titled “Understand Zone Transfer Security”# If fierce returns full zone data, the target has misconfigured AXFR
# This reveals the entire DNS structure
fierce --domain example.com
# Check if nameservers allow transfers
nslookup -type=NS example.com
fierce --domain example.com --nameserver [nameserver-from-above]Common Issues & Troubleshooting
Section titled “Common Issues & Troubleshooting”Excessive False Positives (Wildcard DNS)
Section titled “Excessive False Positives (Wildcard DNS)”# Fierce detects wildcards, but verify manually
nslookup doesnotexist.example.com
# If it resolves, the domain uses wildcard DNS
# Fierce will filter these out automaticallySlow Scanning
Section titled “Slow Scanning”# Increase threads if network allows
fierce --domain example.com --threads 20
# Reduce timeout if network is fast
fierce --domain example.com --timeout 3Blocked by Rate Limiting
Section titled “Blocked by Rate Limiting”# Add delays between requests
fierce --domain example.com --delay 1000
# Use different DNS servers
fierce --domain example.com --nameserver 8.8.8.8No Results For Subdomains
Section titled “No Results For Subdomains”# Try with a larger wordlist
fierce --domain example.com --wordlist /path/to/larger-list.txt
# Some subdomains may require custom wordlistsLegal & Ethical Considerations
Section titled “Legal & Ethical Considerations”- Only use Fierce on systems you own or have explicit written permission to test
- Unauthorized network reconnaissance is illegal
- Use in authorized penetration testing engagements only
- Respect rate limits and don’t cause DoS conditions
- Document all findings and handle data responsibly
Getting Help
Section titled “Getting Help”fierce --help # Show all options
fierce --help | grep -i wordlist # Find specific option
man fierce # Manual page (if installed)See Also
Section titled “See Also”- dnsrecon — Advanced DNS reconnaissance
- dnsenum — DNS enumeration tool
- subfinder — Passive subdomain discovery
- amass — OWASP comprehensive asset discovery
- dig — Manual DNS queries
- nmap — Network scanning and host discovery