--- name: "dnsmap" section: "1" platform: "linux" package: "dnsmap" version: "0.36-4" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/dnsmap" --- # dnsmap(1) scan for subdomains using bruteforcing techniques ## NAME **dnsmap** - scan for subdomains using bruteforcing techniques ## SYNOPSIS ``` dnsmap [options] ``` ## DESCRIPTION **dnsmap scans a domain for common subdomains using a built-in or an external wordlist (if specified** **with -w option). The internal wordlist has around 1000 words in English and Spanish as ns1, firewall,** **servicios and smtp. So will be possible search for smtp.example.com inside example.com automatically.** **Results can be saved in CSV and human-readable format for further processing. dnsmap does NOT require** **root privileges to be run, and should NOT be run with such privileges for security reasons.** **dnsmap was originally released back in 2006 and was inspired by the fictional story "The Thief No One** **Saw" by Paul Craig, which can be found in the book "Stealing the Network - How to 0wn the Box".** **dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of** **infrastructure security assessments. During the enumeration stage, the security consultant would** **typically discover the target company's IP netblocks, domain names, phone numbers, etc.** **Subdomain bruteforcing is another technique that should be used in the enumeration stage, as it's** **especially useful when other domain enumeration techniques such as zone transfers don't work (is** **rare to see zone transfers being publicly allowed these days by the way).** **Fun things that can happen:** - 1\. **Finding interesting remote access servers (e.g.: https://extranet.example.com).** - 2\. **Finding badly configured and/or unpatched servers (e.g.: test.example.com).** - 3\. **Finding new domain names which will allow you to map non-obvious/hard-to-find netblocks of your** **target organization (registry lookups - aka whois is your friend).** - 4\. **Sometimes you find that some bruteforced subdomains resolve to internal IP addresses (RFC 1918).** **This is great as sometimes they are real up-to-date "A" records which means that it \*is\* possible** **to enumerate internal servers of a target organization from the Internet by only using standard** **DNS resolving (as opposed to zone transfers for instance).** - 5\. **Discover embedded devices configured using Dynamic DNS services (e.g.: IP Cameras). This method** **is an alternative to finding devices via Google hacking techniques.** ## OPTIONS - **-w \** **Use an external wordlist instead of the built-in one. You can use programs** **as crunch or cupp to generate personalized wordlists.** - **-r \** **Save results to a plain text file. If a file name isn't supplied, dnsmap will** **create an unique filename which includes the current timestamp. e.g.:** **dnsmap\_example\_com\_br\_2019\_11\_15\_214812.txt. So, you can provide a directory** **name only, as -r /tmp.** - **-c \** **Save results in CSV format in a file. If a file name isn't provided, dnsmap** **will create something as dnsmap\_example\_com\_br\_2019\_11\_15\_220114.csv. This** **is a similar behaviour from -r option.** - **-d \** **Limit of random delay in milliseconds between successive queries. Delay** **value is a maximum random value. e.g. if you enter 1000, each DNS request** **will be delayed a \*maximum\* of 1 second. By default, dnsmap uses a value** **of 10 milliseconds of maximum delay between DNS lookups. It is recommended** **to use the -d (delay in milliseconds) option in cases where dnsmap is** **interfering with your online experience. i.e.: killing your bandwidth. If** **used, delay must be between 1 and 300000 milliseconds (5 minutes).** - **-i \** **IP addresses to ignore in the results (useful if you get obtaining false** **positives). Use commas without spaces to separate the IP addresses. The** **maximum number of IPs to filter is 5. Example: 203.0.113.10,198.51.199.65** ## INTERNAL WORDLIST **The built-in wordlist is defined in src/dnsmap.h file. If needed, see the file to know all words.** ## EXAMPLES **Subdomain bruteforcing using dnsmap's built-in wordlist:** ``` $ dnsmap example.com ``` **Subdomain bruteforcing using a user-supplied wordlist:** ``` $ dnsmap example.com -w wordlist.txt ``` **Subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/ :** ``` $ dnsmap example.com -r /tmp ``` **Example of subdomain bruteforcing using the built-in wordlist, saving the results to /tmp/, and waiting** **a random maximum of 300 milliseconds between each request:** ``` $ dnsmap example.com -r /tmp/ -d 300 ``` **Subdomain bruteforcing with 0.8 seconds delay, saving results in regular and CSV format, filtering 2** **user-provided IP and using a user-supplied wordlist:** ``` $ dnsmap example.com -d 800 -r /tmp/ -c /tmp/ -i 10.55.206.154,10.55.24.100 -w ./wordlist_TLAs.txt ``` ## BUGS **Currently, dnsmap does not yet support parallel scanning and hence take quite a long time.** **New bugs should be reported at https://github.com/resurrecting-open-source-projects/dnsmap/issues** ## SEE ALSO **[crunch(1)](/crunch/1.md), [cupp(1)](/cupp/1.md), [dnsmap-bulk(1)](/dnsmap-bulk/1.md)** ## AUTHOR **dnsmap was originally written by "pagvac" in 2006. Currently it is maintained by volunteers,** **inside dnsmap project, at https://github.com/resurrecting-open-source-projects/dnsmap/** **This manpage was written by Joao Eriberto Mota Filho.**