dnsrecon1
Dns enumeration and scanning tool
Usage
dnsrecon [-h]
[-d
DOMAIN]
[-n
NS_SERVER]
[-r
RANGE]
[-D
DICTIONARY]
[-f]
[-a]
[-s]
[-b]
[-k]
[-w]
[-z]
[-y]
[--threads
THREADS]
[--lifetime
LIFETIME]
[--tcp]
[--db
DB]
[-x
XML]
[-c
CSV]
[-j
JSON]
[--iw]
[--disable_check_recursion]
[--disable_check_bindversion]
[-v]
[-V]
[-t
TYPE]
Overview
dsnrecon is a simple python script that enables to gather DNS-oriented information on a given target.
Options
-
-h, --help -
show help message and exit
-
-d DOMAIN, --domain DOMAIN -
Target domain.
-
-n NS_SERVER, --name_server NS_SERVER -
Domain server to use. If none is given, the SOA of the target will be used. Multiple servers can be specified using a comma separated list.
-
-r RANGE, --range RANGE -
IP range for reverse lookup brute force in formats (first-last) or in (range/bitmask).
-
-D DICTIONARY, --dictionary DICTIONARY -
Dictionary file of subdomain and hostnames to use for brute force. Filter out of brute force domain lookup, records that resolve to the wildcard defined IP address when saving records.
-
-f -
Filter out of brute force domain lookup, records that resolve to the wildcard defined IP address when saving records.
-
-a -
Perform AXFR with standard enumeration.
-
-b -
Perform Bing enumeration with standard enumeration.
-
-s -
Perform a reverse lookup of IPv4 ranges in the SPF record with standard enumeration.
-
-y -
Perform Yandex enumeration with standard enumeration.
-
-k -
Perform crt.sh enumeration with standard enumeration.
-
-w -
Perform deep whois record analysis and reverse lookup of IP ranges found through Whois when doing a standard enumeration.
-
-z -
Performs a DNSSEC zone walk with standard enumeration.
-
--threads THREADS -
Number of threads to use in reverse lookups, forward lookups, brute force and SRV record enumeration.
-
--lifetime LIFETIME -
Time to wait for a server to respond to a query. default is 3.
-
--tcp -
Use TCP protocol to make queries.
-
--db DB -
SQLite 3 file to save found records.
-
-x XML, --xml XML -
XML file to save found records.
-
-c CSV, --csv CSV -
Comma separated value file.
-
-j JSON, --json JSON -
JSON file.
-
--iw -
Continue brute forcing a domain even if wildcard records are discovered.
-
--disable_check_recursion -
Disables check for recursion on name servers
-
--disable_check_bindversion -
Disables check for BIND version on name servers
-
-v -
Enable verbose
-
-V -
Show version
-
-t TYPE, --type TYPE -
Type of enumeration to perform. There are several possible types:
-
•
std: SOA, NS, A, AAAA, MX and SRV.
-
•
rvl: Reverse lookup of a given CIDR or IP range.
-
•
brt: Brute force domains and hosts using a given dictionary.
-
•
srv: SRV records.
-
•
axfr: Test all NS servers for a zone transfer.
-
•
bing: Perform Bing search for subdomains and hosts.
-
•
yand: Perform Yandex search for subdomains and hosts.
-
•
crt: Perform crt.sh search for subdomains and hosts.
-
•
snoop: Perform cache snooping against all NS servers for a given domain, testing all with file containing the domains, file given with -D option.
-
•
tld: Remove the TLD of given domain and test against all TLDs registered in IANA.
-
•
zonewalk: Perform a DNSSEC zone walk using NSEC records.
Examples
- attempts a zone transfer (AXFR) on the zonetransfer.me domain
-
dnsrecon -t axfr -d zonetransfer.me
Releases
5 releases since Debian 9 (Stretch); the text changed 4 times.
--csv since Debian 12 (Bookworm);
--db since Debian 12 (Bookworm);
--dictionary since Debian 12 (Bookworm);
--disable_check_bindversion since Debian 12 (Bookworm);
--disable_check_recursion since Debian 12 (Bookworm);
--domain since Debian 12 (Bookworm);
--help since Debian 12 (Bookworm);
--iw since Debian 12 (Bookworm);
--json since Debian 12 (Bookworm);
--lifetime since Debian 12 (Bookworm);
--name_server since Debian 12 (Bookworm);
--range since Debian 12 (Bookworm);
--tcp since Debian 12 (Bookworm);
--threads since Debian 12 (Bookworm);
--type since Debian 12 (Bookworm);
--xml since Debian 12 (Bookworm);
-D since Debian 12 (Bookworm);
-V since Debian 12 (Bookworm);
-a since Debian 12 (Bookworm);
-b since Debian 12 (Bookworm);
-c since Debian 12 (Bookworm);
-d since Debian 12 (Bookworm);
-f since Debian 12 (Bookworm);
-h since Debian 12 (Bookworm);
-j since Debian 12 (Bookworm);
-k since Debian 12 (Bookworm);
-n since Debian 12 (Bookworm);
-r since Debian 12 (Bookworm);
-s since Debian 12 (Bookworm);
-t since Debian 12 (Bookworm);
-v since Debian 12 (Bookworm);
-w since Debian 12 (Bookworm);
-x since Debian 12 (Bookworm);
-y since Debian 12 (Bookworm);
-z since Debian 12 (Bookworm).