DNSENUM(1)

🌈 DNSENUM(1) — bestie's guide to the multithread script that enumerates info on a domain and discovers non-contiguous IP blocks 💅

okay so. this page lives in the User Contributed Perl Documentation corner of your system, and it's your bestie's guide to dnsenum. buckle up, it's giving recon era. 🦋

✨ VERSION ✨

dnsenum version 1.3.1 — yes she's on 1.3.1, no cap. 👑

🎀 SYNOPSIS 🎀

dnsenum [options] <domain> -f dns.txt

💖 DESCRIPTION 💖

okay so the supported operations are literally: nslookup, zonetransfer, google scraping, domain brute force (recursion too, she ate), whois ip and reverse lookups. periodt. 🫶

The operations, in order, and I need you to follow along because they build on each other:

1. Get the host's address (A record). 🌸
2. Get the nameservers (threaded). ⚡
3. Get the MX record (threaded). ⚡
4. Perform AXFR queries on nameservers (threaded). 🔥
5. Get extra names and subdomains via google scraping (google query = -www site:domain). 🔍
6. Brute force subdomains from (REQUIRED), can also perform recursion on subdomain that have NS records (all threaded). 😭
7. Calculate Class C IP network ranges from the results and perform whois queries on them (threaded). 🧚
8. Perform reverse lookups on netranges (class C or/and whois netranges)(threaded). 💀
9. Write to domain_ips.txt file non-contiguous ip-blocks results. 📝

---

✨ OPTIONS ✨

lowkey the most important thing first: the brute force -f switch takes priority over the default dns.txt. 💅

🌟 GENERAL OPTIONS 🌟

• --dnsserver <server> — Use this DNS server to perform all A, NS and MX queries, the AXFR and PTR queries are sent to the domain's NS servers. no like fr, those AXFR and PTR ones go to the domain's NS servers, not your fancy custom one. 🙈
• --enum — Shortcut option equivalent to --threads 5 -s 20 -w. the lazy girl's combo meal, iconic. 🍓
• -h, --help — Print the help message. bestie behaviour. 🫶
• --noreverse — Skip the reverse lookup operations. Reverse lookups can take long time on big netranges. ⏳
• --nocolor — Disable ANSIColor output. This option is only intended to be used on consoles that do not support color output. (so if your terminal can do color, don't come for me) 🎨
• --private — Show and save private ips at the end of the file domain_ips.txt. 🔒
• --subfile <file> — Write all valid subdomains to this file. Subdomains are taken from NS and MX records, zonetransfer, google scraping, brute force and reverse lookup hostnames. all the sources, all together, ngl. 📂
• -t, --timeout <value> — The tcp and udp timeout values in seconds (default: 10s). ⏰
• --threads <va> — The number of threads that will perform different queries. go off, parallelism. 🧵
• -v, --verbose — Be verbose (show all the progress and all the error messages). she's not shy, she's just talkative. 💬

Notes: neither the default domain nor the resolver search list are appended to domains that don't contain any dots. so bare single-word names stay bare, k? 🫠

🔍 GOOGLE SCRAPING OPTIONS 🔍

This function will scrap subdomains from google search, using query: -www site:domain. okay so basically we're asking google politely. 💖

• -p, --pages <value> — The number of google search pages to process when scraping names, the -s switch must be specified, (default: 20 pages). 📄
• -s, --scrap <value> — The maximum number of subdomains that will be scraped from google. 🎯

NOTES: Google can block our queries with the malware detection. Http proxy options for google scraping are automatically loaded from the environment if the vars http_proxy or HTTP_PROXY are present. "http_proxy=http://127.0.0.1:8118/" or "HTTP_PROXY=http://127.0.0.1:8118/". On IO errors the mechanize browser object will automatically call die. like literally die. the script ends. 💀

💥 BRUTE FORCE OPTIONS 💥

• -f, --file <file> — Read subdomains from this file to perform brute force. 📖
• -u, --update <a|g|r|z> — Update the file specified with the -f switch with valid subdomains. 🧾
  • -u a — Update using all results. 🌈
  • -u g — Update using only google scraping results. 🔍
  • -u r — Update using only reverse lookup results. ↩️
  • -u z — Update using only zonetransfer results. 🌐
• -r, --recursion — Recursion on subdomains, brute force all discovered subdomains that have an NS record. 🌀

NOTES: To perform recursion first we must check previous subdomains results (zonetransfer, google scraping and brute force) for NS records after that we perform brute force on valid subdomains that have NS records and so on. NS, MX and reverse lookup results are not concerned. so don't @ them. 🙅‍♀️

🕵️ WHOIS IP OPTIONS 🕵️

Perform whois ip queries on c class netanges discovered from previous operations. (yes, "netanges", that's the original's typo, I'm not frauding it 💅)

• -d, --delay <value> — The maximum value of seconds to wait between whois queries, the value is defined randomly, (default: 3s). 🎲
• -w, --whois — Perform the whois queries on c class network ranges. ⚠️ Warning: this can generate very large netranges and it will take lot of time to perform reverse lookups. like. a LOT. 😭

NOTES: whois servers will limit the number of connections. and also: The whois query should recursively query the various whois providers until it gets the more detailed information including either TechPhone or OrgTechPhone by default. See: perldoc Net::Whois::IP. On errors the netrange will be a default c class /24. 🫶

🔄 REVERSE LOOKUP OPTIONS 🔄

• -e, --exclude <regexp> — Exclude PTR records that match the regexp expression from reverse lookup results, useful on invalid hostnames. 🚫

NOTES: PTR records that not match the domain are also excluded. Verbose mode will show all results. so if you're nosy, add the verbose flag, bestie. 👀

---

🌸 OUTPUT FILES 🌸

Final non-contiguous ip blocks are written to domain_ips.txt file. 📁

NOTES: Final non-contiguous ip blocks are calculated : ✨

1. From reverse lookups that were performed on netranges ( c class network ranges or whois netranges ). 🌐
2. If the noreverse switch is used then they are calculated from previous operations results (nslookups, zonetransfers, google scraping and brute forcing). 🧮

🦋 README 🦋

dnsenum: multithread script to enumerate information on a domain and to discover non-contiguous ip blocks. — yeah that's the whole vibe.

💜 PREREQUISITES 💜

Modules that are included in perl 5.28.0: Getopt::Long, IO::File, Thread::Queue.

Other Necessary modules: Must have: Net::DNS, Net::IP, Net::Netmask. Optional: Net::Whois::IP, HTML::Parser, WWW::Mechanize.

Perl ithreads modules (perl must be compiled with ithreads support): threads, threads::shared.

👑 AUTHORS 👑

Filip Waeytens <filip.waeytens[at]gmail.com>

tix tixxDZ <tixxdz[at]gmail.com>

🌟 MAINTAINER 🌟

Network Silence

🎀 COPYRIGHT 🎀

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

🌈 SCRIPT CATEGORIES 🌈

Networking DNS

---

okay bestie that's the whole page, we served, we ate, no crumbs left. 🍽️💅

this gorgeous thing was brought to you by perl v5.40.1, dated 2026-01-16, and it's the one and only DNSENUM(1). mwah. 💖✨🎀