dnsmap 0.22 Released – Subdomain Bruteforcing Tool


dnsmap is a subdomain bruteforcer for stealth enumeration, you could say something similar to Reverse Raider or DNSenum.

Originally released in 2006, dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would typically discover the target company’s IP netblocks, domain names, phone numbers, etc. dnsmap was included in Backtrack 2 and 3, although the version included is the now dated version 0.1.

Subdomain brute-forcing is another technique that should be used in the enumeration stage, as it’s especially useful when other domain enumeration techniques such as zone transfers don’t work (public zone transfers rarely work nowadays).

Original Features of Version 0.1

  • obtain all IP addresses (A records) associated to each successfully bruteforced subdomain, rather than just one IP address per subdomain
  • abort the bruteforcing process in case the target domain uses wildcards
  • ability to be able to run the tool without providing a wordlist by using a built-in list of keywords
  • bruteforcing by using a user-supplied wordlist (as opposed to the built-in wordlist)

New Improvements in Version 0.22

  • saving the results in human-readable and CSV format for easy processing
  • fixed bug that disallowed reading wordlists with DOS CRLF format
  • improved built-in subdomains wordlist
  • new bash script (dnsmap-bulk.sh) included which allows running dnsmap against a list of domains from a user-supplied file.
  • bypassing of signature-based dnsmap detection by generating a proper pseudo-random subdomain when checking for wildcards

You can download dnsmap 0.22 here:

dnsmap-0222tar.gz (Make sure you add another . before the tar)

Or read more here.

Posted in: Hacking Tools, Networking Hacking

,


Latest Posts:


RandIP - Network Mapper To Find Servers RandIP – Network Mapper To Find Servers
RandIP is a nim-based network mapper application that generates random IP addresses and uses sockets to test whether the connection is valid or not with additional tests for Telnet and SSH.
Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
BloodHound - Hacking Active Directory Trust Relationships BloodHound – Hacking Active Directory Trust Relationships
BloodHound is for hacking active directory trust relationships and it uses graph theory to reveal the hidden and often unintended relationships within an AD environment.


2 Responses to dnsmap 0.22 Released – Subdomain Bruteforcing Tool

  1. GNa March 18, 2009 at 7:32 pm #

    dnsmap link is wrong
    the right link was:
    http://www.gnucitizen.org/static/blog/2009/03/dnsmap-0222tar.gz
    and you need to rename the downloaded file so tar.gz has a dot before it…

  2. Darknet March 19, 2009 at 6:36 am #

    Thanks, have fixed the link.