Kali Information Collection ~ 3. subdomain names

Kali Information Collection ~ 3. subdomain names

3.1 Netcraft: subdomain name query

Official Website: http://searchdns.netcraft.com/

Enter the domain name to be queried to know the subdomain name.

3.2 Fierce: subdomain name query

Overview:

Fierce is a DNS Server Enumeration Tool that uses multiple technologies to scan the IP address and host name of the target host. Apply recursion to work. It first queries the local DNS server to find the target DNS server, and then uses the target DNS server to find the subdomain name. Fierce can be used to locate the domain name and host name corresponding to the independent IP address space.

Parameters:

Root @ Kali:/home/dnt # fierce-h

Fierce. pl (C) Copywrite-By RSnake at http://ha.ckers.org/fierce/

Usage: perl fierce. pl [-dns example.com] [OPTIONS]

Overview:

Fierce is a semi-lightweight handle that helps locate non-contiguous

IP space and hostnames against specified domains. It's really meant

As a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all

Of those require that you already know what IP space you are looking

For. This does not perform exploitation and does not scan the whole

Internet indiscriminately. It is meant specifically to locate likely

Targets both inside and outside a knife ate network. Because it uses

DNS primarily you will often find mis-configured networks that leak

Internal address space. That's especially useful in targeted malware.

Options:

-Connect Attempt to make http connections to any non RFC1918

(Public) addresses. This will output the return headers

Be warned, this cocould take a long time against a company

Many targets, depending on network/machine lag. I wouldn't

Recommend doing this unless it's a small company or you have

Lot of free time on your hands (cocould take hours-days ).

Inside the file specified the text "Host: \ n" will be replaced

By the host specified. Usage:

Perl fierce. pl-dns example.com-connect headers.txt

-Delay The number of seconds to wait between lookups.

-Dns The domain you wowould like scanned.

-Dnsfile Use DNS servers provided by a file (one per line)

Reverse lookups (brute force ).

-Dnsserver Use a particle DNS server for reverse lookups

(Probably shocould be the DNS server of the target). Fierce

Uses your DNS server for the initial SOA query and then uses

The target's DNS server for all additional queries by default.

-File A file you wowould like to output to be logged.

-Fulloutput When combined with-connect this will output everything

The webserver sends back, not just the HTTP headers.

-Help This screen.

-Nopattern Don't use a search pattern when looking for nearby

Hosts. Instead dump everything. This is really noisy

Is useful for finding other domains that spammers might be

Using. It will also give you lots of false positives,

Especially on large domains.

-Range Scan an internal IP range (must be combined

-Dnsserver). Note, that this does not support a pattern

And will simply output anything it finds. Usage:

Perl fierce. pl-range 111.222.333.0-255-dnsserver ns1.example. co

-Search Search list. When fierce attempts to traverse up and

Down ipspace it may encounter other servers within other

Domains that may belong to the same company. If you supply

Comma delimited list to fierce it will report anything found.

This is especially useful if the specified ate servers are named

Different from the public facing website. Usage:

Perl fierce. pl-dns examplecompany.com-search corpcompany, blahcompany

Note that using search cocould also greatly expand the number

Hosts found, as it will continue to traverse once it locates

Servers that you specified in your search list. The more

Better.

-Suppress Suppress all TTY output (when combined with-file ).

-Tcptimeout Specify a different timeout (default 10 seconds). You

May want to increase this if the DNS server you are querying

Is slow or has a lot of network lag.

-Threads Specify how many threads to use while scanning (default

Is single threaded ).

-Traverse Specify a number of IPs above and below whatever IP you

Have found to look for nearby IPs. Default is 5 abve and

Below. Traverse will not move into other C blocks.

-Version Output the version number.

-Wide Scan the entire class C after finding any matching

Hostnames in that class C. This generates a lot more traffic

But can uncover a lot more information.

-Wordlist Use a seperate wordlist (one word per line). Usage:

Perl fierce. pl-dns examplecompany.com-wordlist dictionary.txt

Instance: threads is the number of threads and can be specified by yourself.

Root @ Kali:/home/dnt # fierce-dns cnblogs.com-threads 100

Trying zone transfer first...

Unsuccessful in zone transfer (it was worth a shot)

Okay, trying the good old fashioned way... brute force

Checking for wildcard DNS...

** Found 99901599299.cnblogs.com at 42.121.252.58.

** High probability of wildcard DNS.

Now faster Ming 2280 test (s )...

120.26.70.206 files.cnblogs.com

42.121.129.234 images.cnblogs.com

223.6.251.45 group.cnblogs.com

223.6.251.45 home.cnblogs.com

42.121.129.234 download.cnblogs.com

221.181.200.235 cdn.cnblogs.com

42.121.131.85 mail.cnblogs.com

42.121.129.234 downloads.cnblogs.com

223.6.251.45 news.cnblogs.com

223.6.251.45 ad.cnblogs.com

42.121.254.229 p.cnblogs.com

........