dnsmap(1)

💖 dnsmap — like, the manual page bestie 💖

okay so you're reading the dnsmap(1) page from section 1 of the manual, and honestly? you came to the right place. sit down, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

dnsmap — scan for subdomains using bruteforcing techniques 🦋

---

🌸 SYNOPSIS 🌸

dnsmap <target-domain> [options]

that's it. that's the whole vibe. domain in, options after, slay. 👑

---

💜 DESCRIPTION 💜

okay so dnsmap scans a domain for common subdomains, and it does that using either a built-in wordlist or an external one (which you'd pass with the -w option, iykyk). the internal wordlist has around 1000 words in English and Spanish, like ns1, firewall, servicios and smtp. so basically it's gonna automatically go looking for smtp.example.com inside example.com. no cap. 🔥

results can be saved in CSV and human-readable format for further processing, because we love a girl who gives you options. 💅

and here's the important part, bestie: dnsmap does NOT require root privileges to be run, and it should NOT be run with such privileges, for security reasons. periodt.

dnsmap was originally released back in 2006 and was inspired by the fictional story "The Thief No One Saw" by Paul Craig, which you can find in the book "Stealing the Network - How to 0wn the Box". iconic origin story tbh. 📚

dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. during the enumeration stage, the security consultant would typically discover the target company's IP netblocks, domain names, phone numbers, etc.

subdomain bruteforcing is another technique that should be used in the enumeration stage, because it's especially useful when other domain enumeration techniques such as zone transfers don't work (and ngl, it's rare to see zone transfers being publicly allowed these days by the way). 🙈

---

🎀 Fun things that can happen 🎀

1. finding interesting remote access servers (e.g.: https://extranet.example.com).
2. finding badly configured and/or unpatched servers (e.g.: test.example.com). 😭
3. finding new domain names which will allow you to map non-obvious/hard-to-find netblocks of your target organization (registry lookups — aka whois is your friend).
4. sometimes you find that some bruteforced subdomains resolve to internal IP addresses (RFC 1918). this is great as sometimes they are real up-to-date "A" records, which means that it is possible to enumerate internal servers of a target organization from the Internet by only using standard DNS resolving (as opposed to zone transfers for instance). main character energy fr fr. ✨
5. discover embedded devices configured using Dynamic DNS services (e.g.: IP Cameras). this method is an alternative to finding devices via Google hacking techniques. 📷

---

✨ OPTIONS ✨

• -w <wordlist-file> — use an external wordlist instead of the built-in one. you can use programs as crunch or cupp to generate personalized wordlists. 🧚
• -r <regular-results-file> — save results to a plain text file. if a file name isn't supplied, dnsmap will create a unique filename which includes the current timestamp. e.g.: dnsmap_example_com_br_2019_11_15_214812.txt. so, you can provide a directory name only, as -r /tmp. 💾
• -c <csv-results-file> — save results in CSV format in a file. if a file name isn't provided, dnsmap will create something as dnsmap_example_com_br_2019_11_15_220114.csv. this is a similar behaviour from the -r option. 🍓
• -d <delay-millisecs> — limit of random delay in milliseconds between successive queries. the delay value is a maximum random value. e.g. if you enter 1000, each DNS request will be delayed a maximum of 1 second. by default, dnsmap uses a value of 10 milliseconds of maximum delay between DNS lookups. it is recommended to use the -d (delay in milliseconds) option in cases where dnsmap is interfering with your online experience. i.e.: killing your bandwidth. if used, delay must be between 1 and 300000 milliseconds (5 minutes). 🐌
• -i <ips-to-ignore> — IP addresses to ignore in the results (useful if you get obtaining false positives). use commas without spaces to separate the IP addresses. the maximum number of IPs to filter is 5. example: 203.0.113.10,198.51.199.65 🚫

---

🦋 INTERNAL WORDLIST 🦋

the built-in wordlist is defined in src/dnsmap.h file. if needed, see the file to know all words. go peek, bestie, it's all right there. 👀

---

🌈 EXAMPLES 🌈

subdomain bruteforcing using dnsmap's built-in wordlist:

$ dnsmap example.com

subdomain bruteforcing using a user-supplied wordlist:

$ dnsmap example.com -w wordlist.txt

subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/:

$ dnsmap example.com -r /tmp

example of subdomain bruteforcing using the built-in wordlist, saving the results to /tmp/, and waiting a random maximum of 300 milliseconds between each request:

$ dnsmap example.com -r /tmp/ -d 300

subdomain bruteforcing with 0.8 seconds delay, saving results in regular and CSV format, filtering 2 user-provided IP and using a user-supplied wordlist:

$ dnsmap example.com -d 800 -r /tmp/ -c /tmp/ -i 10.55.206.154,10.55.24.100 -w ./wordlist_TLAs.txt

---

💀 BUGS 💀

currently, dnsmap does not yet support parallel scanning and hence take quite a long time. 😭 she's thorough, okay? she's doing her best.

new bugs should be reported at https://github.com/resurrecting-open-source-projects/dnsmap/issues — please be nice when you do it. 🫶

---

👑 SEE ALSO 👑

crunch(1), cupp(1), dnsmap-bulk(1)

---

💅 AUTHOR 💅

dnsmap was originally written by "pagvac" in 2006. currently it is maintained by volunteers, inside dnsmap project, at https://github.com/resurrecting-open-source-projects/dnsmap/

this manpage was written by Joao Eriberto Mota Filho.

---

💖 and that's the whole page bestie! this was dnsmap-0.36, dated 25 Feb 2021 — shoutout to the dnsmap(1) girlies, go enumerate responsibly. mwah! 💋✨🎀