DNSRECON(1)

💖 DNSRECON(1) 💖

okay bestie, sit down, hydrate, because we're about to talk about dnsrecon from the General Commands Manual (section 1, obviously, it's giving main character CLI energy) and it's gonna be a whole journey 🦋

---

✨ NAME ✨

dnsrecon — the DNS Enumeration and Scanning Tool. yes that's literally its whole name. iconic. no notes. 💅

---

🌸 SYNOPSIS 🌸

dnsrecon [-h] [-d DOMAIN] [-iL INPUT_LIST] [-n NS_SERVER] [-r RANGE] [-D
DICTIONARY] [-f] [-a] [-s] [-b] [-y] [-k] [-w] [--shodan] [--shodan-
active] [--shodan-key SHODAN_KEY] [-z] [--threads THREADS] [--lifetime
LIFETIME] [--loglevel LEVEL] [--tcp] [--db DB] [-x XML] [-c CSV] [-j
JSON] [--iw] [--disable_check_nxdomain] [--disable_check_recursion]
[--disable_recurs] [--disable_check_bindversion] [-v] [-V] [-t TYPE]

look at all those flags. she's got range. 🎀

---

💜 DESCRIPTION 💜

so like, dnsrecon is a simple python script that enables you to gather DNS-oriented information on a given target. that's it. that's the vibe. lowkey does a LOT though. 🔥

---

👑 OPTIONS 👑

• -h, --help — shows you the help message and then exits. the classic "wait what do i do" move 😭
• -d DOMAIN, --domain DOMAIN — your target domain. the one you're being nosy about. 💖
• -iL INPUT_LIST, --input-list INPUT_LIST — a file containing a list of domains to perform DNS enumeration on, one per line. bulk mode, we love her. ✨
• -n NS_SERVER, --name_server NS_SERVER — the domain server to use. if none is given, the SOA of the target will be used. and you can specify multiple servers using a comma separated list, because why choose one 🫶
• -r RANGE, --range RANGE — IP range for reverse lookup brute force, in formats (first-last) or in (range/bitmask).
• -D DICTIONARY, --dictionary DICTIONARY — dictionary file of subdomain and hostnames to use for brute force. bring your own wordlist bestie 📚
• -f — filters out of brute force domain lookup the records that resolve to the wildcard defined IP address when saving records. keeping things tidy, we stan a clean output. 🧚
• -a — perform AXFR with standard enumeration. zone transfer time?? 👀
• -b — perform Bing enumeration with standard enumeration.
• -s — perform a reverse lookup of IPv4 ranges in the SPF record with standard enumeration.
• -y — perform Yandex enumeration with standard enumeration.
• -k — perform crt.sh enumeration with standard enumeration.
• -w — perform deep whois record analysis and reverse lookup of IP ranges found through Whois when doing a standard enumeration. she's thorough. 💅
• --shodan — use Shodan to query netblocks discovered via SPF (-s) and/or Whois (-w) during standard enumeration.
• --shodan-active — actively validate Shodan-discovered names by resolving them and confirming they still match the queried netblock. no ghost data allowed 🙈
• --shodan-key SHODAN_KEY — your Shodan API key. if you omit it, the SHODAN_API_KEY environment variable is used instead. ✨
• -z — performs a DNSSEC zone walk with standard enumeration.
• --threads THREADS — number of threads to use in reverse lookups, forward lookups, brute force and SRV record enumeration. go fast, but like, responsibly 🏃♀️
• --lifetime LIFETIME — time to wait for a server to respond to a query. default is 3.0. ⏳
• --loglevel LEVEL — set the log level. possible values are DEBUG, INFO, WARNING, ERROR, CRITICAL. default is INFO.
• --tcp — use the TCP protocol to make queries instead of, y'know, the other one. 🌈
• --db DB — SQLite 3 file to save found records.
• -x XML, --xml XML — XML file to save found records.
• -c CSV, --csv CSV — comma separated value file.
• -j JSON, --json JSON — save output to a JSON file. for the json girlies 💖
• --iw — continue brute forcing a domain even if wildcard records are discovered. stubborn? no, dedicated. 😤
• --disable_check_nxdomain — disables the check for NXDOMAIN hijacking on name servers.
• --disable_check_recursion — disables the check for recursion on name servers.
• --disable_recurs — disable the recursion desired flag in queries.
• --disable_check_bindversion — disables the check for BIND version on name servers.
• -v — enable verbose. tell me EVERYTHING 🗣️
• -V — show version.
• -t TYPE, --type TYPE — the type of enumeration to perform. there are several possible types, and this is where it gets fun:
  • std: SOA, NS, A, AAAA, MX and SRV.
  • rvl: reverse lookup of a given CIDR or IP range.
  • brt: brute force domains and hosts using a given dictionary.
  • srv: SRV records.
  • axfr: test all NS servers for a zone transfer.
  • bing: perform Bing search for subdomains and hosts.
  • yand: perform Yandex search for subdomains and hosts.
  • crt: perform crt.sh search for subdomains and hosts.
  • caa: CAA records.
  • snoop: perform cache snooping against all NS servers for a given domain, testing all with file containing the domains, file given with -D option.
  • tld: remove the TLD of given domain and test against all TLDs registered in IANA.
  • zonewalk: perform a DNSSEC zone walk using NSEC records.

---

🌟 EXAMPLES 🌟

this one attempts a zone transfer (AXFR) on the zonetransfer.me domain. go little rockstar 🎸

dnsrecon -t axfr -d zonetransfer.me

---

and that's the whole page bestie, no cap. this gorgeous specimen of documentation lives in the General Commands Manual as DNSRECON(1) — section 1, where all the cool user commands hang out 🫶💖 go enumerate something responsibly, mwah ✨🎀🦋