ToolWar | Information Security (InfoSec) Tools: DNS

Sublist3r - Subdomain Enumeration / Scanner : Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX9xrud6fayQX7f2OmbYU-qjmsBfi35Y0IOMLeMSt1J-XnREvEI3TP99ySPRbENncML8CtP-8Nj8ppzVMR1nkfJWP_4ACocVhp1ZkHhCTFlQlNxlDPkC0htQNyVAN8KELdRTWwRfydGVt3/s1600/Sublist3r.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Sublist3r - Subdomain Enumeration" border="0" data-original-height="413" data-original-width="867" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX9xrud6fayQX7f2OmbYU-qjmsBfi35Y0IOMLeMSt1J-XnREvEI3TP99ySPRbENncML8CtP-8Nj8ppzVMR1nkfJWP_4ACocVhp1ZkHhCTFlQlNxlDPkC0htQNyVAN8KELdRTWwRfydGVt3/s400/Sublist3r.JPG" title="Sublist3r - Subdomain Scanner" width="400" /></a></div>
<div style="text-align: justify;">
Sublist3r is a python tool designed to enumerate subdomains of websites 
using OSINT. It helps penetration testers and bug hunters collect and 
gather subdomains for the domain they are targeting. Sublist3r 
enumerates subdomains using many search engines such as Google, Yahoo, 
Bing, Baidu, and Ask. Sublist3r also enumerates subdomains using 
Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and ReverseDNS.</div>
<div style="text-align: justify;">
<br /></div>
<h2 style="text-align: justify;">
<span style="font-size: large;">Installation:</span></h2>
<blockquote class="tr_bq">
<pre><code>git clone https://github.com/aboul3la/Sublist3r.git</code></pre>
</blockquote>
<b><span style="font-size: small;">Dependencies:</span></b><br />
<blockquote class="tr_bq">
<pre><code>sudo pip install -r requirements.txt</code></pre>
</blockquote>
<b><span style="font-size: small;">How To Use:</span></b> <br />
<blockquote class="tr_bq">
<span style="font-size: large;"> </span><code>python sublist3r.py -v -d example.com</code></blockquote>
where -V : Verbose, -d : Domain<br />
<br />
<h3>
<b>Download:: </b> </h3>
Linux & Windows : <a href="https://github.com/aboul3la/Sublist3r" rel="nofollow" target="_blank">Sublis3r (Official Page)</a>

Sublist3r - Subdomain Enumeration / Scanner : Tools

Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collec...

WhatWeb (Identifies Websites) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1Y3Xc5XJJiJAmm6k8YcIZNOrOB7uG7CgdTi3S5kN-OmfZ98jwawq6HH-Ntm-wT192dKf5QrY_p3LgrMXJGEVlT8HbDjmC9PZILfoV_kY9uhM5FewuU0d2gOcSmRjuqbeh80xsr9j3mUSS/s1600/whatweb+screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="WhatWeb Screenshot" border="0" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1Y3Xc5XJJiJAmm6k8YcIZNOrOB7uG7CgdTi3S5kN-OmfZ98jwawq6HH-Ntm-wT192dKf5QrY_p3LgrMXJGEVlT8HbDjmC9PZILfoV_kY9uhM5FewuU0d2gOcSmRjuqbeh80xsr9j3mUSS/s400/whatweb+screenshot.png" title="WhatWeb Screenshot" width="400" /></a></div>
<div style="text-align: justify;">
<b>WhatWeb </b><i>identifies websites.</i> Its goal is to answer the question, 
“<i>What is that Website?”</i>. <b>WhatWeb</b> recognises <i>web technologie</i>s including 
content management systems (CMS), blogging platforms, 
statistic/analytics packages, JavaScript libraries, web servers, and 
embedded devices. WhatWeb has over 900 plugins, each to recognise 
something different. WhatWeb also identifies version numbers, email 
addresses, account IDs, web framework modules, SQL errors, and more.</div>
<div style="text-align: justify;">
<b>WhatWeb</b> can be stealthy and fast, or thorough but slow. <b>WhatWeb</b> 
supports an aggression level to control the trade off between speed and 
reliability. When you visit a website in your browser, the transaction 
includes many hints of what web technologies are powering that website. 
Sometimes a single webpage visit contains enough information to identify
 a website but when it does not, <b>WhatWeb</b> can interrogate the website 
further. The default level of aggression, called ‘passive’, is the 
fastest and requires only one HTTP request of a website. This is 
suitable for scanning public websites. More aggressive modes were 
developed for in penetration tests.</div>
<div style="text-align: justify;">
Most WhatWeb plugins are thorough and recognise a range of cues from 
subtle to obvious. For example, most WordPress websites can be 
identified by the meta HTML tag, e.g. ‘‘, but a minority of WordPress 
websites remove this identifying tag but this does not thwart WhatWeb. 
The WordPress <b>WhatWeb</b> plugin has over 15 tests, which include checking 
the favicon, default installation files, login pages, and checking for 
“/wp-content/” within relative links.</div>
<h3>
Features:</h3>
<div style="text-align: justify;">
* Over 900 plugins<br />
* Control the trade off between speed/stealth and reliability<br />
* Plugins include example URLs<br />
* Performance tuning. Control how many websites to scan concurrently.<br />
* Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.<br />
* Recursive web spidering<br />
* Proxy support including TOR<br />
* Custom HTTP headers<br />
* Basic HTTP authentication<br />
* Control over webpage redirection<br />
* Nmap-style IP ranges<br />
* Fuzzy matching<br />
* Result certainty awareness<br />
* Custom plugins defined on the command line</div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://www.morningstarsecurity.com/downloads/whatweb-0.4.7.tar.gz">whatweb-0.4.7.tar.gz</a></div>
<div style="text-align: justify;">
<b>Tutorial :: </b>  <a href="http://www.morningstarsecurity.com/research/whatweb" target="_blank">Click Here </a></div>
<div style="text-align: justify;">
</div>

WhatWeb (Identifies Websites) :: Tools

WhatWeb identifies websites. Its goal is to answer the question, “ What is that Website?” . WhatWeb recognises web technologie s inclu...

DNSRecon (DNS Information Gathering) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBmBNrk2zjtV5xfWpJ9Ho5Dxa_UwHGMt5XrbrxISfORTwpUgIpmszrDOrbLbsO6loanBsuVWDn27vHVtA4zWOLDGCd-r9_Uf7Bc1W2EBm0TDEkMdxq6dRPqXoKZ8Jj5iD12qE0nBpf7Oz_/s1600/dnsrecon1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="dnsrecon" border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgBmBNrk2zjtV5xfWpJ9Ho5Dxa_UwHGMt5XrbrxISfORTwpUgIpmszrDOrbLbsO6loanBsuVWDn27vHVtA4zWOLDGCd-r9_Uf7Bc1W2EBm0TDEkMdxq6dRPqXoKZ8Jj5iD12qE0nBpf7Oz_/s400/dnsrecon1.jpeg" title="dnsrecon" width="400" /></a></div>
<span class="nodeLabelBox repTarget " role="treeitem"><span class="nodeBracket editable insertBefore "></span><span class="nodeText editable "><span class="  "><b>DNS
 reconnaissance or DNSRecon</b> is part of the <i>information gathering stage</i> on a 
penetration test engagement.When a penetration tester is performing a 
DNS reconnaissance is trying to obtain as much as information as he can 
regarding the DNS servers and their records.The information that can be 
gathered it can disclose the network infrastructure of the company 
without alerting the IDS/IPS.This is due that most of the organizations 
are not monitoring their DNS server traffic and those that do they only 
monitor the zone transfers attempts.</span></span></span><br />
<span class="nodeLabelBox repTarget " role="treeitem"><span class="nodeText editable "><span class="  ">On the web there are a variety of tools available that can gather DNS information effectively but in this article we will focus on the DNSRecon which is a tool that was developed by Carlos Perez and it is designed to perform DNS reconnaissance.This tool is included on backtrack and it is written in python. </span></span></span><br />
<b>DNSrecon</b> is a simple tool writen for target <b>enumeration</b> during  authorized penetration test engaments. This tool provides diferent  methods for enumerating targets thru DNS service. </div>
<ul style="text-align: justify;">
<li>Standard Record Enumeration for a given domain (A, NS, SOA and MX). </li>
<li>Top Leven Domain Expansion for a given domain. </li>
<li>Zone Transfer against all NS records of a given domain. </li>
<li>Reverse Lookup against a given IP Range given a start and end IP. </li>
</ul>
<div style="text-align: justify;">
 Here is an Example of the tool enumerating SRV Record and Standard Record.</div>
<pre style="background-color: #fbfbfb; border: 1px solid #cecece; min-height: 40px; overflow: auto; padding: 5px; width: 650px;"><pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 19px; margin: 0em; width: 100%;">root@bt:~# ./dnsrecon.rb -t srv -d avaya.com</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">_sip._udp.avaya.com,198.152.17.90,5060</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; margin: 0em; width: 100%;">_sip._tcp.avaya.com,198.152.17.90,5060</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">root@bt:~# ./dnsrecon.rb -t std -d google.com</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 18px; margin: 0em; width: 100%;">google.com,209.85.171.100,A</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">google.com,74.125.67.100,A</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">google.com,74.125.45.100,A</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 19px; margin: 0em; width: 100%;">ns1.google.com,216.239.32.10,SOA</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">ns4.google.com,216.239.38.10,NS</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 18px; margin: 0em; width: 100%;">ns1.google.com,216.239.32.10,NS</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 18px; margin: 0em; width: 100%;">ns2.google.com,216.239.34.10,NS</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 17px; margin: 0em; width: 100%;">ns3.google.com,216.239.36.10,NS</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 18px; margin: 0em; width: 100%;">smtp4.google.com,72.14.221.25,MX,10</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 19px; margin: 0em; width: 100%;">smtp1.google.com,209.85.237.25,MX,10</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; height: 19px; margin: 0em; width: 100%;">smtp2.google.com,64.233.165.25,MX,10</pre>
<pre style="background-color: #fbfbfb; font-family: consolas,'Courier New',courier,monospace; font-size: 11px; margin: 0em; width: 100%;">smtp3.google.com,209.85.137.25,MX,10</pre>
</pre>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/uy9Z6C8vVRw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br />
<b>Download Here :: </b><a href="https://github.com/darkoperator/dnsrecon/blob/master/dnsrecon.py" target="_blank">dnsrecon.py</a><b>
</b></div>
<div style="text-align: justify;">
<b>Source :: </b><cite>https://github.com/darkoperator/<b>dnsrecon</b></cite></div>
</div>

DNSRecon (DNS Information Gathering) :: Tools

DNS reconnaissance or DNSRecon is part of the information gathering stage on a penetration test engagement.When a penetration tester...

DnsWalk (DNS Debugger) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggh9ptz7RMcUIN0S7vYdjFGEiIuggl4BgFl57Di5eVBDYTyViNa6nJQfw_rsg7al9rQASDXRcO-Fw6jIL1y3JE9pMLwQBuoahSa__orjcZ-KvqaYvTHKo53VnEUuahL4usjaC9DG0-VSQm/s1600/dnswalk+screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="dnswalk screenshot" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggh9ptz7RMcUIN0S7vYdjFGEiIuggl4BgFl57Di5eVBDYTyViNa6nJQfw_rsg7al9rQASDXRcO-Fw6jIL1y3JE9pMLwQBuoahSa__orjcZ-KvqaYvTHKo53VnEUuahL4usjaC9DG0-VSQm/s1600/dnswalk+screenshot.png" title="dnswalk screenshot" /></a></div>
<div style="text-align: justify;">
<b>Dnswalk</b> is a <b>DNS debugger</b>. It performs zone transfers of  specifieddomains, and checks the database in numerous ways for  internalconsistency, as well as accuracy.  <b>dnswalk</b> is not for the faint  of heart.  It should NOT be used without a firm knowledge of the DNS  RFC's.  The warnings and errors must be interpreted within the context they are being used.  Something  may be flagged as a warning, but in reality it is a really bad error. Conversely dnswalk will flag things as warnings and possibly even  errors, but they may actually be perfectly "legal" or normal in your specific situation.  <b>dnswalk </b>is not an AI engine.  It just provides  useful information which you need to interpret. If you use this tool for  cracking or otherwise evil purposes, the author hereby considers you a  slime-ball.</div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/i-KMGQvDOUc?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Download Here :: </b><a href="http://sourceforge.net/projects/dnswalk/files/latest/download" target="_blank">Dnswalk 2.0.2 (for Linux)</a><b>
</b>
<b> </b><br />
<b>Source ::</b> http://sourceforge.net/projects/dnswalk/</div>

DnsWalk (DNS Debugger) :: Tools

Dnswalk is a DNS debugger . It performs zone transfers of specifieddomains, and checks the database in numerous ways for internalcons...

HostMap (Hosts Discovery) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGKwLKElCSEhex-_U5vhK8pGd5CaZoOheAiXG3v0gep9WqvjsG1ezuhfstT4PnSblQG1kBjqmvrn9pgrXFl9uIM2tW8oXHGndJXwmDDNKLJymjRBM4E_ewFeSOdy5ERmljHWZzlmGxW2gy/s1600/Hostmap+image.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hostmap image" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGKwLKElCSEhex-_U5vhK8pGd5CaZoOheAiXG3v0gep9WqvjsG1ezuhfstT4PnSblQG1kBjqmvrn9pgrXFl9uIM2tW8oXHGndJXwmDDNKLJymjRBM4E_ewFeSOdy5ERmljHWZzlmGxW2gy/s1600/Hostmap+image.png" title="hostmap image" /></a></div>
<div style="text-align: justify;">
<b>Hostmap</b> is a free, <i>automatic, hostnames and virtual hosts 
discovery tool</i> written in Ruby by Alessandro `jekil` Tanasi and licensed
 under GNU General Public License version 3 (GPLv3). It's goal is to 
enumerate all hostnames and configured virtual hosts on an IP address. 
The primary users of hostmap are professionals performing vulnerability 
assessments and penetration tests.
</div>
<div style="text-align: justify;">
hostmap helps you using several techniques to enumerate all the hostnames associated with an IP address.
</div>
<div style="text-align: justify;">
The major features are:
</div>
<ul style="text-align: justify;">
<li> DNS names and virtual hosts enumeration
</li>
<li> Multiple discovery techniques, to read more see documentation.
</li>
<li> Results correlation, aggregation and normalization
</li>
<li> Multithreaded and event based engine
</li>
<li> Platform independent
</li>
</ul>
<div style="text-align: justify;">
<b>Downlaod Here ::</b> <a href="https://sourceforge.net/projects/hostmap/files/hostmap/hostmap-0.2/hostmap-0.2.tar.gz/download" target="_blank">Hostmap (for Linux)</a></div>
<div style="text-align: justify;">
<b>Official Website ::</b> http://www.lonerunners.net/ </div>
</div>

HostMap (Hosts Discovery) :: Tools

Hostmap is a free, automatic, hostnames and virtual hosts discovery tool written in Ruby by Alessandro `jekil` Tanasi and licensed u...

DNSTracer (DNS Route) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijwi4woQmAhYPT0HfRIFqdXQpeOUXfuxlKLRCrcPaokynz71x66BXbyCIF6IAC2GsPaQEd1flhUoUmSSzx7TQommBkqteEQLjJBNIeQZ9s_hzczl3cyyIFOlmx7SeuBcVXWwDKLgN4QBdV/s1600/dnstracer+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="dnstracer screenshot" border="0" height="202" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijwi4woQmAhYPT0HfRIFqdXQpeOUXfuxlKLRCrcPaokynz71x66BXbyCIF6IAC2GsPaQEd1flhUoUmSSzx7TQommBkqteEQLjJBNIeQZ9s_hzczl3cyyIFOlmx7SeuBcVXWwDKLgN4QBdV/s400/dnstracer+screenshot.jpg" title="dnstracer screenshot" width="400" /></a></div>
<div style="text-align: justify;">
<b>dnstracer</b> determines where a given <i>Domain Name Server (DNS) gets its information</i> from, and follows the chain of DNS servers back to the servers which know the data.</div>
<br />
Example :-<br />
<pre class="screenshot">[~] edwin@k7><b>dnstracer www.mavetju.org</b>
Tracing to www.mavetju.org via 127.0.0.1, timeout 15 seconds
127.0.0.1 (127.0.0.1)
 |\___ B.ROOT-SERVERS.NET [.] (128.9.0.107)
 |     |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101)
 |     |     |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) Got authoritative answer
 |     |      \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) Got authoritative answer
 |     |\___ E.GTLD-SERVERS.NET [org] (192.12.94.30)
 |     |     |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
 |     |      \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
 |     |\___ K.GTLD-SERVERS.NET [org] (213.177.194.5)
 |     |     |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
 |     |      \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
[...]
 |      \___ A.GTLD-SERVERS.NET [org] (192.5.6.30)
 |           |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
 |            \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
 |\___ F.ROOT-SERVERS.NET [.] (192.5.5.241)
 |     |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101) (cached)
 |     |\___ E.GTLD-SERVERS.NET [org] (192.12.94.30) (cached)
 |     |\___ K.GTLD-SERVERS.NET [org] (213.177.194.5) (cached)
 |     |\___ J.GTLD-SERVERS.NET [org] (210.132.100.101) (cached)
 |     |\___ F.GTLD-SERVERS.NET [org] (192.35.51.30) (cached)
[...]
 |      \___ A.GTLD-SERVERS.NET [org] (192.5.6.30) (cached)
 |\___ G.ROOT-SERVERS.NET [.] (192.112.36.4)
 |     |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101) (cached)
[...]</pre>
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/ibBUa6u9R6Y?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Download Here ::</b> <a href="http://freecode.com/urls/90291af9c8922e02e73b8299afb0f868" target="_blank">dnstracer (for Linux)</a><br />
<b>Source ::</b> http://www.mavetju.org/unix/dnstracer.php</div>

DNSTracer (DNS Route) :: Tools

dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to th...

Fierce (DNS Enumeration) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-d0GilIUG5gDmVrO9tXHE8UJRtwhXIr4VOfgiq6g0SySvlmFZvw7j4UPg3IEW2Ngpv9CxGhO0Cq94iAL9eUmsarmZ8wzwJHgmSM1t3kWG8zfMEfxm7QLPnHMWfkarA-sqsYXQJRJUhROK/s1600/fierce+screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="fierce domain" border="0" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-d0GilIUG5gDmVrO9tXHE8UJRtwhXIr4VOfgiq6g0SySvlmFZvw7j4UPg3IEW2Ngpv9CxGhO0Cq94iAL9eUmsarmZ8wzwJHgmSM1t3kWG8zfMEfxm7QLPnHMWfkarA-sqsYXQJRJUhROK/s400/fierce+screenshot.png" title="fierce domain" width="400" /></a></div>
<div style="text-align: justify;">
<b>Fierce </b>is a <i>DNS Enumeration</i> and <b>Fierce</b> is a <i>semi-lightweight scanner that helps locate non-contiguous IP  space and hostnames</i> against specified domains.  It's really meant as a  pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those  require that you already know what IP space you are looking for.  This  does not perform exploitation and does not scan the whole internet  indiscriminately.  It is meant specifically to locate likely targets  both inside and outside a corporate network.  Because it uses DNS  primarily you will often find mis-configured networks that leak internal  address space. That's especially useful in targeted malware.  <b><br />
</b></div>
<div style="text-align: justify;">
<b>Fierce</b> domain scan was born out of personal frustration after  performing a web application security audit.  It is traditionally very  difficult to discover large swaths of a corporate network that is  non-contiguous.  It's terribly easy to run a scanner against an IP  range, but if the IP ranges are nowhere near one another you can miss  huge chunks of networks.</div>
<div style="text-align: justify;">
First what Fierce is not.  Fierce is not an IP scanner, it is not a  DDoS tool, it is not designed to scan the whole internet or perform any  un-targeted attacks. It is meant specifically to locate likely targets  both inside and outside a corporate network.  Only those targets are  listed (unless the -nopattern switch is used).  No exploitation is  performed (unless you do something intentionally malicious with the  -connect switch).  Fierce is a reconnaissance tool.  Fierce is a PERL  script that quickly scans domains (usually in just a few minutes,  assuming no network lag) using several tactics.</div>
<div style="text-align: justify;">
First it queries your DNS for the DNS servers of the target.  It then  switches to using the target's DNS server (you can use a different one  if you want using the -dnsserver switch but this can cause problems if  the server you use won't tell you information about other people's sites  and of course you won't find much relevant internal address space).   Fierce then attempts to dump the SOA records for the domain in the very  slim hope that the DNS server that your target uses may be  misconfigured.  Once that fails (because it almost always will) it  attempts to "guess" names that are common amongst a lot of different  companies.  Don't ask me where I got the list, it's just a list of names  that id and I have seen all over the place.  I thought about adding a  dictionary to this, but I think that would take a lot longer, and given  that very few of the words are dictionary words I don't think this would  add a lot of value.</div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/il6Ey1sNc0w?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br />
<b>Download Here :: </b><a href="http://ha.ckers.org/fierce/fierce.pl" target="_blank">fierce.pl</a></div>
<div style="text-align: justify;">
<b>Official Website :: </b>http://ha.ckers.org/fierce/</div>
</div>

Fierce (DNS Enumeration) :: Tools

Fierce is a DNS Enumeration and Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames again...

DNSMap (DNS Network Mapper) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtvLH9JV95_ugTvvdVTHaLKagKNfbMcFZroTS2L0UYmecPvN77x5zOtyG23Q0D_KhBl2itBUHXhGHB3ylnVmZDM_HbwONQVFB1JUPOEW8Ngr9Br57qzs4t-Gihxov75rM8h7TIgRrdf158/s1600/dnsmap.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="dnsmap screenshot" border="0" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtvLH9JV95_ugTvvdVTHaLKagKNfbMcFZroTS2L0UYmecPvN77x5zOtyG23Q0D_KhBl2itBUHXhGHB3ylnVmZDM_HbwONQVFB1JUPOEW8Ngr9Br57qzs4t-Gihxov75rM8h7TIgRrdf158/s400/dnsmap.png" title="dnsmap screenshot" width="400" /></a></div>
</div>
<div style="text-align: justify;">
<b>dnsmap</b> is a <i><span itemprop="description">Passive DNS network mapper a.k.a. subdomains bruteforcer</span></i>. <b>dnsmap</b> is mainly meant to be used by pentesters during the <i> information gathering/enumeration phase</i> of infrastructure security  assessments. During the enumeration stage, the security consultant would  typically discover the target company’s IP netblocks, domain names,  phone numbers, etc. dnsmap was included in Backtrack 2 and 3, although the version included is the now dated version 0.1.  </div>
<div style="text-align: justify;">
Subdomain brute-forcing is another technique that should be used in  the enumeration stage, as it’s especially useful when other domain  enumeration techniques such as zone transfers don’t work (I rarely see  zone transfers being publicly allowed these days by the way).<br />
<br />
obtain all IP addresses (A records) associated to each successfully  bruteforced subdomain, rather than just one IP address per subdomain, abort the bruteforcing process in case the target domain uses wildcards , ability to be able to run the tool without providing a wordlist by using a built-in list of keywords, bruteforcing by using a user-supplied wordlist (as opposed to the built-in wordlist).</div>
<h3 style="text-align: justify;">
New Improvements in Version 0.22 - </h3>
<div style="text-align: justify;">
saving the results in human-readable and CSV format for easy processing,fixed bug that disallowed reading wordlists with DOS CRLF format,improved built-in subdomains wordlist,new bash script (<code>dnsmap-bulk.sh</code>) included which allows  running dnsmap against a list of domains from a , user-supplied file.  i.e.: bruteforcing several domains in a bulk fashion, bypassing of signature-based dnsmap detection by generating a proper pseudo-random subdomain when checking for wildcards</div>
<div style="text-align: left;">
<h3 style="text-align: left;">
<span style="font-size: small;">Usage -</span></h3>
<br />
<pre><code>usage: dnsmap <target-domain> [options]
options:
-w <wordlist-file>
-r <results-path>
</code></pre>
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/55ITD0hceio?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br />
<h3>
Example on Live Domain</h3>
The following is just an example so you get an idea of how dnsmap  works. Very simple to use as you can see. If you want to save the  results or use your own wordlist, checkout the usage syntax. Question  for those who pay attention to detail: <i>can you spot the potential leaks of internal IP addresses?</i>
<br />
<pre><code><span style="background-color: #ffd966;">
<span style="background-color: white;">$ dnsmap baidu.com
dnsmap 0.22 - DNS Network Mapper by pagvac (gnucitizen.org)

[+] searching (sub)domains for baidu.com using built-in wordlist

accounts.baidu.com
IP address #1: 10.11.252.74

events.baidu.com
IP address #1: 202.108.23.40

finance.baidu.com
IP address #1: 60.28.250.196
IP address #2: 60.28.251.79
IP address #3: 60.28.251.206
IP address #4: 123.129.240.28
IP address #5: 123.129.240.29
IP address #6: 60.28.250.102
IP address #7: 60.28.250.111

forum.baidu.com
IP address #1: 202.108.250.212

images.baidu.com
IP address #1: 61.135.163.93

mail.baidu.com
IP address #1: 10.23.3.137

mobile.baidu.com
IP address #1: 202.108.23.125

mx.baidu.com
IP address #1: 61.135.163.61

mx1.baidu.com
IP address #1: 61.135.163.61

mx2.baidu.com
IP address #1: 61.135.163.62

mx3.baidu.com
IP address #1: 61.135.162.61

news.baidu.com
IP address #1: 61.135.163.87

ns1.baidu.com
IP address #1: 202.108.22.220

ns2.baidu.com
IP address #1: 61.135.165.235

ns3.baidu.com
IP address #1: 220.181.37.10

oracle.baidu.com
IP address #1: 172.18.0.50

photo.baidu.com
IP address #1: 61.135.163.93

photos.baidu.com
IP address #1: 61.135.163.93

pop.baidu.com
IP address #1: 61.135.166.249

proxy.baidu.com
IP address #1: 202.108.11.30

smtp.baidu.com
IP address #1: 61.135.163.61

vpn.baidu.com
IP address #1: 202.108.250.231

wap.baidu.com
IP address #1: 61.135.163.237

webmail.baidu.com
IP address #1: 61.135.166.249

win.baidu.com
IP address #1: 10.65.19.212

www.baidu.com
IP address #1: 220.181.5.222

www1.baidu.com
IP address #1: 220.181.5.222

www2.baidu.com
IP address #1: 202.108.22.136

www3.baidu.com
IP address #1: 202.108.22.188

[+] 29 (sub)domains and 35 IP address(es) found </span></span>
</code></pre>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Download Here :: </b><a href="http://www.gnucitizen.org/static/blog/2009/03/dnsmap-0222tar.gz">dnsmap-0.22.2.tar.gz</a></div>
<div style="text-align: justify;">
<b>Source :: </b>http://code.google.com/p/dnsmap/</div>
</div>

DNSMap (DNS Network Mapper) :: Tools

dnsmap is a Passive DNS network mapper a.k.a. subdomains bruteforcer . dnsmap is mainly meant to be used by pentesters during the ...

FindDomains :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgee-CM00i0zN_fWK2rWP5z3J5lOCUXIO4zpEYE2FbKy8zhiePxOjjDqv_hppFPjVdu4-_SbjsrUH2JgEH2NCUm2tNpbjcNLVMufw_9PARC_kz4-W3gKvVvH1zfs_yb6HwuL-iXKW89c-Q8/s1600/finddomains.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FindDomains logo" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgee-CM00i0zN_fWK2rWP5z3J5lOCUXIO4zpEYE2FbKy8zhiePxOjjDqv_hppFPjVdu4-_SbjsrUH2JgEH2NCUm2tNpbjcNLVMufw_9PARC_kz4-W3gKvVvH1zfs_yb6HwuL-iXKW89c-Q8/s320/finddomains.png" title="FindDomains logo" width="227" /></a></div>
<div style="text-align: justify;">
<b>FindDomains</b> is a <i>multithreaded search engine discovery tool</i> that will
 be very useful for penetration testers dealing with discovering domain 
names/web sites/virtual hosts which are located on too many IP 
addresses. Provides a console interface so you can easily integrate this
 tool to your pentest automation system. It retrieves domain names/web sites which are located on specified ip address/hostname. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Download Here :: </b><a href="http://finddomains.googlecode.com/files/FindDomainsv0.1.1.rar" target="_blank">FindDomainsv0.1.1 (for Windows)</a><b><br /></b></div>
<div style="text-align: justify;">
<b>Source :: </b>http://code.google.com/p/finddomains/</div>
</div>

FindDomains :: Tools

FindDomains is a multithreaded search engine discovery tool that will be very useful for penetration testers dealing with discovering...

DNSenum (DNS Enumeration) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxNRJcNRL-APPaXbHIFD6jfAfGbCGG1E052DaRrexH-nbnr31HFbWFG7KFm57OfZkJDDRj-ivRZTs9nt-w8RzbgB2kyglNN3h1MccRqG7vMob6eWeouWflpga0z9NFdYUmsxje824PEaUU/s1600/dnsenum.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="dnsenum screenshot" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxNRJcNRL-APPaXbHIFD6jfAfGbCGG1E052DaRrexH-nbnr31HFbWFG7KFm57OfZkJDDRj-ivRZTs9nt-w8RzbgB2kyglNN3h1MccRqG7vMob6eWeouWflpga0z9NFdYUmsxje824PEaUU/s640/dnsenum.png" title="dnsenum screenshot" width="640" /></a></div>
<br />
<span itemprop="description"><b>DNSenum </b>is a <i>pentesting cool created to enumerate DNS info about domains</i></span>. The purpose of <b>Dnsenum</b> is to gather as much information as possible  about a domain. The program currently performs the following operations:  </div>
<div style="text-align: justify;">
1) Get the host's addresse (A record). </div>
<div style="text-align: justify;">
2) Get the namservers  (threaded). </div>
<div style="text-align: justify;">
3) Get the MX record (threaded). </div>
<div style="text-align: justify;">
4) Perform axfr queries on  nameservers and get BIND versions(threaded). </div>
<div style="text-align: justify;">
5) Get extra names and  subdomains via google scraping (google query = "allinurl: -www  site:domain"). </div>
<div style="text-align: justify;">
6) Brute force subdomains from file, can also perform  recursion on subdomain that have NS records (all threaded). </div>
<div style="text-align: justify;">
7) Calculate  C class domain network ranges and perform whois queries on them  (threaded). </div>
<div style="text-align: justify;">
8) Perform reverse lookups on netranges ( C class or/and  whois netranges) (threaded). </div>
<div style="text-align: justify;">
9) Write to domain_ips.txt file ip-blocks.<br />
<h3>
Tutorials ::  </h3>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Sk7NI6LDkJQ?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/h-emEp6n9Fk?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download :: </h3>
<b>Linux :: </b><a href="http://dnsenum.googlecode.com/files/dnsenum-1.2.2.tar.gz" target="_blank">DNSenum 1.2.2 (for Linux)</a><b>
</b></div>
<div style="text-align: justify;">
<b>Source :: </b><a href="http://code.google.com/p/dnsenum/">http://code.google.com/p/dnsenum/</a></div>
</div>

DNSenum (DNS Enumeration) :: Tools

DNSenum is a pentesting cool created to enumerate DNS info about domains . The purpose of Dnsenum is to gather as much information as ...

Subscribe to: Posts ( Atom )