tools

Overview

DNSenum is a DNS enumeration tool written in Perl that automates the discovery of subdomains, DNS records, zone transfers, and brute-forced hostnames for a target domain. It queries the DNS server directly, attempts zone transfers to retrieve the full DNS zone, and falls back to wordlist-based brute-force enumeration. DNSenum can also scrape Google for additional subdomains and perform reverse lookups and WHOIS queries in a single pass.

Key capabilities:

  • DNS Record Enumeration — A, AAAA, NS, MX, and TXT records for a comprehensive DNS overview
  • Zone Transfer Attempts — automatically tries AXFR against all discovered nameservers
  • Subdomain Brute-Forcing — wordlist-based enumeration of candidate subdomains
  • Google Scraping — queries Google to find additional subdomains not listed in DNS records directly
  • Reverse Lookup — identifies domains associated with discovered IP addresses via PTR records
  • WHOIS Lookup — performs WHOIS queries on discovered domains for ownership and registration details

Target / Context

DNS servers for a target domain — used during external recon to enumerate subdomains, mail servers, name servers, and attempt unauthorized zone transfers.

Installation

ℹ︎Installation Commands: 
sudo apt install dnsenum

Basic Usage

ℹ︎Basic Usage:

Enumerate a domain against a specific DNS server:

dnsenum --dnsserver <dns_server_ip> --enum -p 0 -s 0 <target_domain>

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
—dnsserverSpecify the DNS server to query—dnsserver 10.129.14.128
—enumEnable full enumeration mode—enum
-pNumber of Google pages to scrape for subdomains (0 = disable)-p 0
-sNumber of scraping results to return (0 = disable)-s 0
-oOutput file for results-o subdomains.txt
-fWordlist for subdomain brute forcing-f /path/to/wordlist.txt
—threadsNumber of threads—threads 10
—noreverseSkip reverse lookups—noreverse
—nocolorDisable colored output—nocolor
-rEnable recursive enumeration on subdomains-r

Common Use Cases

Full Subdomain Enumeration Against Internal DNS Server

ℹ︎Commands: 
dnsenum --dnsserver 10.129.14.128 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb

External Domain Enumeration (Public DNS)

ℹ︎Commands: 
dnsenum --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt targetcompany.com

Zone Transfer Attempt

DNSenum automatically attempts AXFR zone transfers against all name servers found. If a zone transfer succeeds, the full DNS zone is returned without needing a wordlist.

ℹ︎Commands:

Zone transfer attempt is automatic during —enum. To test manually with dig:

dig axfr <domain> @<nameserver>

Manual Subdomain Brute Force Loop (without DNSenum)

ℹ︎Commands: 
for sub in $(cat /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt); do
  dig $sub.inlanefreight.htb @10.129.14.128 \
  | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt
done

References / Images