Ultimate Fierce Cheat Sheet

Samir KC

September 09, 2026 September 09, 2026

Ultimate Fierce Cheat Sheet

DNS reconnaissance tool for locating non-contiguous IP space and hostnames. Perfect for internal and external network mapping.

1. Basic Usage

DNS enumeration and subdomain discovery with Fierce.

Basic Domain Scan

fierce --domain example.com

Scan with DNS Server

fierce --domain example.com --dns-server 8.8.8.8

Quick Scan

fierce --domain example.com --quick

Verbose Output

fierce --domain example.com --verbose

Show Help

fierce --help

Basic Flags

--domain <name> : Target domain
--dns-server <ip> : Custom DNS
--quick : Quick scan mode
--verbose : Verbose output
--help : Help menu

Quick Examples

fierce --domain tesla.com
fierce --domain google.com --quick
fierce --domain apple.com --dns-server 1.1.1.1
fierce --domain amazon.com --verbose

2. Wordlists & Brute Force

Default Wordlist Scan

fierce --domain example.com

Uses built-in wordlist with common subdomain names.

Custom Wordlist

fierce --domain example.com --wordlist /path/to/wordlist.txt

Large Wordlist with Threads

fierce --domain example.com --wordlist /usr/share/wordlists/subdomains.txt --threads 50

Subdomain Brute Force

fierce --domain example.com --subdomains www,mail,ftp,admin,dev,test,staging

Combined Wordlist and Subdomains

fierce --domain example.com --wordlist custom.txt --subdomains api,portal,vpn,secure

Wordlist Options

--wordlist <file> : Custom wordlist
--subdomains <list> : Specific subs
--threads <num> : Thread count
--traverse <num> : Recursion depth

Popular Wordlists

SecLists/Discovery/DNS/subdomains-top1million-5000.txt
SecLists/Discovery/DNS/dns-Jhaddix.txt
SecLists/Discovery/DNS/namelist.txt
SecLists/Discovery/DNS/fierce-hostlist.txt

Pro Tip: Effective Brute Forcing
Start with quick scan, then expand:
fierce --domain example.com --quick
fierce --domain example.com --wordlist top-5000.txt
fierce --domain example.com --wordlist full-list.txt --threads 100

3. IP Range Scanning

Scan IP Range

fierce --domain example.com --range 192.168.1.0/24

Reverse DNS on Range

fierce --domain example.com --range 10.0.0.0/24 --dns-server 10.0.0.1

Wide Range Scan

fierce --domain example.com --range 172.16.0.0/16

Multiple Ranges

fierce --domain example.com --range 192.168.1.0/24,10.0.0.0/24

Flag	Description	Example
`--range <cidr>`	IP range to scan	`--range 192.168.1.0/24`
`--dns-server <ip>`	DNS for reverse lookup	`--dns-server 8.8.8.8`
`--tcp`	TCP for DNS queries	`--tcp`
`--connect <host:port>`	Test connectivity	`--connect example.com:80`

Pro Tip: Range Scanning
Combine range scanning with reverse DNS:
fierce --domain example.com --range 192.168.1.0/24 --dns-server 192.168.1.1
This discovers internal hosts through reverse DNS lookups.

4. Advanced Features

Recursive Traversal

fierce --domain example.com --traverse 10

Recursively scan discovered subdomains up to 10 levels deep.

TCP Queries

fierce --domain example.com --tcp

Use TCP instead of UDP for DNS queries.

Connectivity Testing

fierce --domain example.com --connect example.com:80

Delay Between Queries

fierce --domain example.com --delay 100

Search for Specific Records

fierce --domain example.com --search google,aws,azure,office365

Wide Search

fierce --domain example.com --wide

Advanced Flags

--traverse <num> : Recursion depth
--tcp : TCP queries
--connect <h:p> : Test connection
--delay <ms> : Query delay
--search <terms> : Search filters

Search Options

--wide : Wide search
--quick : Quick scan
--verbose : Verbose output
--debug : Debug mode

5. Output Formats

Default Output

fierce --domain example.com

Save to File

fierce --domain example.com --output results.txt

JSON Output

fierce --domain example.com --json results.json

XML Output

fierce --domain example.com --xml results.xml

All Formats

fierce --domain example.com --output results.txt --json results.json --xml results.xml

Output Flags

--output <file> : Text output
--json <file> : JSON format
--xml <file> : XML format
--debug : Debug output

Processing Results

grep : Filter results
sort -u : Deduplicate
jq : Process JSON
wc -l : Count results

6. Automation Scripts

Complete DNS Enumeration

#!/bin/bash # dns-enum.sh - Complete DNS enumeration with Fierce DOMAIN=$1 OUTPUT_DIR="fierce-$DOMAIN" mkdir -p $OUTPUT_DIR echo "[+] Quick scan..." fierce --domain $DOMAIN --quick --output $OUTPUT_DIR/quick.txt echo "[+] Full wordlist scan..." fierce --domain $DOMAIN --wordlist /usr/share/wordlists/subdomains.txt --output $OUTPUT_DIR/bruteforce.txt echo "[+] Range scan..." fierce --domain $DOMAIN --range 192.168.1.0/24 --output $OUTPUT_DIR/range.txt echo "[+] Done! Results in $OUTPUT_DIR/"

Multi-Domain Scanner

#!/bin/bash # multi-scan.sh - Scan multiple domains while read -r domain; do echo "[+] Scanning $domain..." fierce --domain "$domain" --json "results-$domain.json" # Extract subdomains from JSON jq -r '.subdomains[]' "results-$domain.json" | sort -u > "subdomains-$domain.txt" echo "[+] Found $(wc -l < subdomains-$domain.txt) subdomains" done < domains.txt

Subdomain Monitor

#!/bin/bash # monitor.sh - Monitor for new subdomains DOMAIN=$1 PREVIOUS="previous.txt" CURRENT="current.txt" while true; do fierce --domain "$DOMAIN" --json results.json jq -r '.subdomains[]' results.json | sort -u > "$CURRENT" if [ -f "$PREVIOUS" ]; then echo "[+] New subdomains found:" diff "$PREVIOUS" "$CURRENT" | grep "^>" | sed 's/^> //' fi mv "$CURRENT" "$PREVIOUS" sleep 86400 done

Range Mapper

#!/bin/bash # range-map.sh - Map network ranges DOMAIN=$1 RANGES_FILE="ranges.txt" OUTPUT="range-map.txt" while read -r range; do echo "[+] Scanning $range..." fierce --domain "$DOMAIN" --range "$range" --json "range-$range.json" # Extract hosts jq -r '.hosts[] | "\(.ip) -> \(.hostname)"' "range-$range.json" >> "$OUTPUT" done < "$RANGES_FILE" echo "[+] Results in $OUTPUT" cat "$OUTPUT"

DNS Security Check

#!/bin/bash # dns-check.sh - DNS security verification DOMAIN=$1 REPORT="dns-report-$DOMAIN.txt" echo "DNS Security Report for $DOMAIN" > "$REPORT" echo "================================" >> "$REPORT" echo "[+] Testing with different DNS servers..." for dns in 8.8.8.8 1.1.1.1 9.9.9.9; do echo "DNS Server: $dns" >> "$REPORT" fierce --domain "$DOMAIN" --dns-server "$dns" --quick >> "$REPORT" done echo "[+] Testing TCP queries..." fierce --domain "$DOMAIN" --tcp >> "$REPORT" echo "[+] Report: $REPORT"

Pro Tip: Integration with Other Tools

Combine Fierce with other recon tools:
cat <(fierce --domain example.com) <(dnsrecon -d example.com) <(sublist3r -d example.com) | sort -u > all-subs.txt
Then verify with httprobe:
cat all-subs.txt | httprobe > live-subs.txt

⇧

Reconnaissance & OSINT