DNS
Last updated
Was this helpful?
Last updated
Was this helpful?
The basic command is like this
Dig, short for Domain Information Groper, is another tool to query DNS servers. Type dig -h to retrieve a list of options:
To query a specific record type you can use the -t option (just like with Host). The following command retrieves the mx (mail exchange) records for the domain:
Or you can request all records by specifying ‘any’ as a parameter:
We can also test for zone transfers with Dig using the following command:
Fierce is a reconnaissance tool written in Perl to locate non-contiguous IP space and hostnames using DNS. This tool helps to locate likely targets both inside and outside corporate networks.
By default, Fierce uses its own wordlist, but you can also use your own wordlist by specifying it in the wordlist option as follows:
WildCard DNS
If the request for this domain doesn’t match any of the explicitly defined records it will finally match against the wildcard DNS record and return the default IP associated with the wildcard DNS record.
DNSenum is a Perl script that can be used to enumerate the DNS information of a domain and to discover non-contiguous IP blocks. This tool will also attempt zone transfers on all the related domain name servers. Use the following command to use DNSenum on a specific target:
DNSrecon is another automated tool that can be used to query DNS records, check for zone transfers and other DNS related information. This tool shows more or less the same output as we’ve already seen in the other (automated) DNS reconnaissance tools
Note: is a great project to educate people about the implications of zone transfers. More information about zone transfers and the project is available here:
Type fierce -h for a list of options and usage instructions. Let’s run Fierce on the ‘’ domain with the following command:
So, what exactly is the purpose of checking for a Wildcard DNS record? Many DNS and subdomain enumeration tools use wordlists to test for common subdomains, like in the last step of the Fierce scan. As you can see from the Fierce example above, the tool first makes a request for a subdomain that is very unlikely to exist ( for example) before brute forcing common names.