FIERCE(1)

💖 FIERCE(1) 💖

okay bestie, welcome to the fierce manual page — it lives in the General Commands Manual section, and it's about to be your new fave little DNS gremlin 🦋✨

---

🌸 NAME 🌸

fierce — a DNS scanner that helps locate non-contiguous IP space and hostnames against specified domains. periodt. 💅

---

✨ SYNOPSIS ✨

fierce [-h] [--domain DOMAIN] [--connect] [--wide] [--traverse TRAVERSE]
[--search SEARCH [SEARCH ...]] [--range RANGE] [--delay DELAY]
[--subdomains SUBDOMAINS [SUBDOMAINS ...] | --subdomain-file
SUBDOMAIN_FILE] [--dns-servers DNS_SERVERS [DNS_SERVERS ...] | --dns-
file DNS_FILE] [--tcp]

like, that's the whole vibe in one breath. no cap. 🫶

---

🌈 DESCRIPTION 🌈

so fierce is a semi-lightweight scanner and its whole thing is helping you locate non-contiguous IP space and hostnames against specified domains. it's literally built to be a pre-cursor to nmap, OpenVAS, nikto, etc — because all of those are out here requiring that you already know what IP space you're looking for. rude of them honestly. 🙈

the way that fierce differs: it does not perform exploitation, and it does not scan the whole internet indiscriminately. it is meant specifically to locate likely targets both inside and outside a corporate network. iconic behavior. 👑

and because it uses DNS primarily, you will often find mis-configured networks that leak internal address space. that's especially useful in targeted malware. 👀 lowkey scary, highkey fascinating.

origin story time 💫 — it was originally written by RSnake along with others at http://ha.ckers.org/. this version is simply a conversion to Python 3 to simplify and modernize the codebase. glow-up complete. 🧚

---

💅 OPTIONS 💅

one bullet per flag, bestie, we do not skip:

• -h, --help — show this help message and exit
• --domain DOMAIN — domain name to test
• --connect — attempt HTTP connection to non-RFC 1918 hosts
• --wide — scan entire class c of discovered records
• --traverse TRAVERSE — scan IPs near discovered records, this won't enter adjacent class c's
• --search SEARCH [SEARCH ...] — filter on these domains when expanding lookup
• --range RANGE — scan an internal IP range, use cidr notation
• --delay DELAY — time to wait between lookups
• --subdomains SUBDOMAINS [SUBDOMAINS ...] — use these subdomains
• --subdomain-file SUBDOMAIN_FILE — use subdomains specified in this file (one per line)
• --dns-servers DNS_SERVERS [DNS_SERVERS ...] — use these dns servers for reverse lookups
• --dns-file DNS_FILE — use dns servers specified in this file for reverse lookups (one per line)
• --tcp — use TCP instead of UDP

---

🎀 EXAMPLES 🎀

something basic 🍓

$ fierce --domain google.com --subdomains accounts admin ads

traverse IPs near discovered domains 🔥

to search for contiguous blocks, hit the --traverse flag:

$ fierce --domain facebook.com --subdomains admin --traverse 10

limit nearby IP traversal to certain domains 🔍

use the --search flag for that:

$ fierce --domain facebook.com --subdomains admin --search fb.com fb.net

attempt an HTTP connection 🌐

on domains discovered, with the --connect flag:

$ fierce --domain stackoverflow.com --subdomains mail --connect

exchange speed for breadth 🦋

the --wide flag looks for nearby domains on all IPs of the /24 of a discovered domain — and yeah, /24 is the CIDR thing, wiki is at https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#IPv4_CIDR_blocks if you wanna nerd out:

$ fierce --domain facebook.com --wide

zone transfers 👑

zone transfers are rare these days, but they give us the keys to the DNS castle. zonetransfer.me (linked from https://digi.ninja/projects/zonetransferme.php) is a very useful service for testing for and learning about zone transfers:

$ fierce --domain zonetransfer.me

save your results 💾

to save the results to a file for later use we can simply redirect output:

$ fierce --domain zonetransfer.me > output.txt

internal networks 🏠

internal networks will often have large blocks of contiguous IP space assigned. we can scan those as well:

$ fierce --dns-servers 10.0.0.1 --range 10.0.0.0/24

---

⭐ friendly reminder from your local DNS girlie: fierce doesn't exploit anything and doesn't scan the whole internet indiscriminately — it's a pre-cursor to nmap, OpenVAS, nikto, etc. stay classy, stay authorized. 💜

---

okay that's the whole page!! this was FIERCE(1) from the General Commands Manual — no version number or date stamped anywhere on it, so like, that's genuinely all the metadata we got, bestie 😭💖 mwah, go scan responsibly ✨🦋🎀