There is another option for DNS Brute Forcing which uses threads, so may be faster than TXDNS 2.0 which we posted about recently.

What does it do?

This program was written to extract valid hosts of a domain that deny zone transfers.

The program supports:

• IPv4 => IP Address of 32 bits.
• IPv6 => IP Address of 128 bits.
• Multi Thread => Make several resolutions at “the same time”.
• EMA => Extract more than 1 IP in servers with HA, Network Load Balance, etc, (like: www.yahoo.com, www.microsoft.com).

Where do I use it?

This program must be used against DNS Servers that deny zone transfers.

Example of DNS Servers that deny transfer zones:

root@Debian:/tmp/WS-DNS# host -l frontthescene.com.br
;; connection timed out; no servers could be reached

root@Debian:/tmp/WS-DNS# dig @200.242.154.2 frontthescene.com.br axfr

; <<>> DiG 9.2.1 <<>> @200.242.154.2 frontthescene.com.br axfr
;; global options:  printcmd
; Transfer failed.

How do I compile it?

To compile it, do:

gcc -o WS-DNS-BFX WS-DNS-BFX.c -lpthread -D_REENTRANT -D_THREAD_SAFE

To best performance do:

gcc -o WS-DNS-BFX WS-DNS-BFX.c -lpthread -D_REENTRANT -D_THREAD_SAFE -O3

If u don’t have a compiler (gcc), libs, etc, i added at the .tgz file this program compiled static, called “WS-DNS-BFX-Static”.

How do I use it?

Is easy use this program. Supose that you want extract valid hosts from “yahoo.com”, using dict-file.txt (Brute Force File) and open 4 threads, to do it the command is:

root@Debian:/tmp/WS-DNS# ./WS-DNS-BFX yahoo.com dict-file.txt 4
     Progress ..............................

When it finish, will be generated a file called “hosts-yahoo.com.txt” with the extracted hosts.

You can download it here:

DNS Brute Force eXtract

TXDNS 2.0.0 has been released.

TXDNS is a Win32 aggressive multithreaded DNS digger. Capable of placing, on the wire, thousands of DNS queries per minute. TXDNS main goal is to expose a domain namespace trough a number of techniques:

• Typos
• TLD rotation
• Dictionary attack
• Brute force

This new version features a distributed model which further boosts TXDNS’s parallelism and performance. This model allows a TXDNS client to send jobs to a TXDNS server over a clear or encrypted TCP channel.

For example, to put a TXDNS host on listening mode:

> txdns -l

By default TXDNS listens on port 5353. On the client side you may postany query jobs by appending ‘-c xx.xx.xx.xx’ to the regular query syntax (where xx.xx.xx.xx is the host’s IP running TXDNS on listening mode), for example:

   > txdns foo.com -rt -t -c xx.xx.xx.xx

Using -cr instead of -c will force the TXDNS server to redirect all output to the client, so basically you get the results from the server’s job right on the client console. Note that file system streams are not redirected, which means that any file switches (-f or -h) will still have the remote host as root reference.

To encrypt all the traffic between the client and the server just append ‘–key ‘ to the regular syntax on both the client and server.

A new –countdown option has been added as a very basic synchronization mechanism, and by default, any jobs, no matter remote or local will now delay for 5s before firing. If you want to bypass this countdown delay you’ll have to add ‘–countdown 0′.

You can read more and download at:

http://www.txdns.net