Ultimate DNSenum Cheat Sheet
Ultimate DNSenum Cheat Sheet
Comprehensive DNS enumeration tool. Performs zone transfers, brute forcing, reverse lookups, and Google scraping.
1. Basic Enumeration
Standard DNS enumeration with zone transfer and record discovery.
Basic Domain Scan
dnsenum example.com
Verbose Output
dnsenum --verbose example.com
Save to XML
dnsenum --xml output.xml example.com
Save to Text
dnsenum -o output.txt example.com
With Custom DNS Server
dnsenum --dnsserver 8.8.8.8 example.com
Skip Zone Transfer
dnsenum --noreverse --noaxfr example.com
Basic Flags
--verbose: Verbose output--dnsserver <ip>: Custom DNS-o <file>: Text output--xml <file>: XML output--noreverse: Skip reverse
Quick Examples
dnsenum tesla.comdnsenum --verbose google.comdnsenum -o results.txt apple.comdnsenum --dnsserver 1.1.1.1 amazon.com
2. Brute Force & Wordlists
Default Brute Force
dnsenum --enum example.com
Uses built-in wordlist with common subdomain names.
Custom Wordlist
dnsenum -f /path/to/wordlist.txt example.com
Wordlist with Threads
dnsenum -f /usr/share/wordlists/subdomains.txt --threads 50 example.com
Subdomain File Output
dnsenum -f wordlist.txt -s subdomains.txt example.com
Multiple Wordlists
dnsenum -f wordlist1.txt -f wordlist2.txt example.com
Brute Force Flags
--enum: Brute force mode-f <file>: Custom wordlist--threads <num>: Thread count-s <file>: Save subdomains
Popular Wordlists
SecLists/Discovery/DNS/subdomains-top1million-5000.txtSecLists/Discovery/DNS/dns-Jhaddix.txtSecLists/Discovery/DNS/namelist.txt/usr/share/dnsenum/dns.txt
Pro Tip: Brute Force Strategy
Start with small wordlist for quick results:
Then expand with larger lists:
Use
Start with small wordlist for quick results:
dnsenum -f top-1000.txt example.comThen expand with larger lists:
dnsenum -f top-10000.txt --threads 100 example.comUse
-s to save discovered subdomains for later.
3. Search Engine Scraping
Google Scraping
dnsenum --scrape google example.com
Bing Scraping
dnsenum --scrape bing example.com
Multiple Search Engines
dnsenum --scrape google,bing,yahoo example.com
Scraping with Limit
dnsenum --scrape google --scrape_limit 100 example.com
Scraping with Output
dnsenum --scrape google -o scraped.txt example.com
| Search Engine | Description | Use Case |
|---|---|---|
google | Google search | Comprehensive results |
bing | Bing search | Alternative results |
yahoo | Yahoo search | Additional coverage |
ask | Ask.com | Less filtered results |
netcraft | Netcraft data | Historical data |
virustotal | VirusTotal DNS | Threat intelligence |
Pro Tip: Scraping Limitations
Search engines may rate-limit or block scraping. Use:
Combine multiple engines for better coverage.
Search engines may rate-limit or block scraping. Use:
--scrape_limit to control results--delay to add delays between queriesCombine multiple engines for better coverage.
4. Reverse Lookups
Reverse DNS on Range
dnsenum --reverse 192.168.1.0/24 example.com
Reverse with Custom DNS
dnsenum --reverse 10.0.0.0/24 --dnsserver 10.0.0.1 example.com
Disable Reverse Lookup
dnsenum --noreverse example.com
Reverse on Multiple Ranges
dnsenum --reverse 192.168.1.0/24 --reverse 10.0.0.0/24 example.com
Reverse Lookup Options
--reverse <range>: Reverse DNS range--noreverse: Skip reverse lookup--dnsserver <ip>: Custom DNS server--threads <num>: Thread count
Reverse Lookup Uses
- Discover internal hosts
- Map network topology
- Identify hidden services
- Find PTR records
5. Advanced Features
Zone Transfer Test
dnsenum --axfr example.com
Skip Zone Transfer
dnsenum --noaxfr example.com
WHOIS Lookup
dnsenum --whois example.com
Skip WHOIS
dnsenum --nowhois example.com
Thread Control
dnsenum --threads 100 example.com
Delay Between Queries
dnsenum --delay 1 example.com
Full Enumeration
dnsenum --enum --scrape google --axfr --reverse 192.168.1.0/24 example.com
| Flag | Description | Example |
|---|---|---|
--axfr | Force zone transfer | --axfr |
--noaxfr | Skip zone transfer | --noaxfr |
--whois | WHOIS lookup | --whois |
--nowhois | Skip WHOIS | --nowhois |
--threads <num> | Thread count | --threads 100 |
--delay <sec> | Query delay | --delay 1 |
--private | Show private IPs | --private |
--subdomains | Show subdomains | --subdomains |
6. Automation Scripts
Complete DNS Enumeration
#!/bin/bash
# dns-enum.sh - Complete DNS enumeration
DOMAIN=$1
OUTPUT_DIR="dnsenum-$DOMAIN"
mkdir -p $OUTPUT_DIR
echo "[+] Basic enumeration..."
dnsenum -o $OUTPUT_DIR/basic.txt $DOMAIN
echo "[+] Brute force..."
dnsenum -f /usr/share/wordlists/subdomains.txt -s $OUTPUT_DIR/subdomains.txt $DOMAIN
echo "[+] Google scraping..."
dnsenum --scrape google -o $OUTPUT_DIR/scraped.txt $DOMAIN
echo "[+] Zone transfer..."
dnsenum --axfr -o $OUTPUT_DIR/zonetransfer.txt $DOMAIN
echo "[+] Complete! Results in $OUTPUT_DIR/"
Multi-Domain Scanner
#!/bin/bash
# multi-scan.sh - Scan multiple domains
while read -r domain; do
echo "[+] Scanning $domain..."
dnsenum --enum --scrape google -o "results-$domain.txt" "$domain"
# Extract subdomains
grep -E "^[a-zA-Z0-9.-]+\.$domain$" "results-$domain.txt" | sort -u > "subdomains-$domain.txt"
echo "[+] Found $(wc -l < subdomains-$domain.txt) subdomains"
done < domains.txt
Zone Transfer Monitor
#!/bin/bash
# zone-monitor.sh - Monitor for zone transfer vulnerabilities
DOMAIN=$1
while true; do
echo "[+] Testing zone transfer for $DOMAIN..."
dnsenum --axfr -o zone-test.txt "$DOMAIN"
if grep -q "Zone Transfer" zone-test.txt; then
echo "[!] Zone transfer successful!"
notify "Zone transfer found for $DOMAIN"
fi
sleep 86400
done
Network Range Mapper
#!/bin/bash
# range-map.sh - Map network ranges
DOMAIN=$1
RANGES="ranges.txt"
OUTPUT="range-map.txt"
while read -r range; do
echo "[+] Scanning $range..."
dnsenum --reverse "$range" -o "range-$range.txt" "$DOMAIN"
# Extract PTR records
grep -E "PTR" "range-$range.txt" >> "$OUTPUT"
done < "$RANGES"
echo "[+] Results in $OUTPUT"
cat "$OUTPUT"
DNS Security Audit
#!/bin/bash
# dns-audit.sh - DNS security audit
DOMAIN=$1
REPORT="dns-audit-$DOMAIN.txt"
echo "DNS Security Audit for $DOMAIN" > "$REPORT"
echo "================================" >> "$REPORT"
echo "[+] Testing zone transfer..."
dnsenum --axfr "$DOMAIN" >> "$REPORT"
echo "[+] WHOIS lookup..."
dnsenum --whois "$DOMAIN" >> "$REPORT"
echo "[+] Google scraping..."
dnsenum --scrape google "$DOMAIN" >> "$REPORT"
echo "[+] Reverse DNS..."
dnsenum --reverse 192.168.1.0/24 "$DOMAIN" >> "$REPORT"
echo "[+] Audit complete! Report: $REPORT"
Pro Tip: Integration with Other Tools
Combine DNSenum with other recon tools:
cat <(dnsenum --enum example.com) <(fierce --domain example.com) <(dnsrecon -d example.com) | sort -u > all-subs.txt
Then verify with httprobe:
cat all-subs.txt | httprobe > live-subs.txt
And scan with nuclei:
cat live-subs.txt | nuclei -t ~/nuclei-templates/
.png)
Post a Comment