dnsenum
DNS enumeration and reconnaissance tool
TLDR
SYNOPSIS
dnsenum [options] domain
DESCRIPTION
dnsenum is a DNS enumeration tool that gathers information about a domain's DNS infrastructure. It performs multiple queries to discover hosts, name servers, mail servers, and potential subdomains.The tool attempts zone transfers, performs reverse lookups, and can brute force subdomains using wordlists. It also scrapes search engines for additional subdomain information and integrates results from multiple sources.dnsenum is commonly used in penetration testing and security assessments to map an organization's DNS footprint and identify potential attack vectors.
PARAMETERS
DOMAIN
Target domain to enumerate.--dnsserver SERVER
DNS server to query.--enum
Shortcut equivalent to --threads 5 -s 15 -w.-f FILE
Subdomain wordlist for brute force.--threads N
Number of threads for parallel queries.-o FILE
Write output to FILE in XML (magictree) format.--noreverse
Skip reverse lookups.--private
Show and save private (RFC 1918) IP addresses.-p N, --pages N
Number of Google search pages to scrape (default 5).-s N, --scrap N
Maximum number of subdomains scraped from Google.-r, --recursion
Recurse on discovered subdomains.-w, --whois
Perform whois queries on class C network ranges.--help
Display help information.
INSTALL
CAVEATS
Only perform on domains you have authorization to test. Zone transfers typically blocked on properly configured servers. Brute forcing may be detected and blocked. Search scraping may hit rate limits.
HISTORY
dnsenum is a Perl-based tool developed for the security community. It became a standard reconnaissance tool in penetration testing distributions like Kali Linux, providing comprehensive DNS enumeration capabilities.
