DMitry (Deepmagic Information Gathering Tool): Complete OSINT Reconnaissance Guide

Long before I run an active scan against anything, I want a passive picture of the target — whois data, subdomains, open ports observed from a TCP grab, and any email addresses that might be floating around public sources. DMitry, short for Deepmagic Information Gathering Tool, is one of the older but still genuinely useful all-in-one OSINT utilities that bundles several of those lookups into a single command. I still reach for it early in engagements because it’s fast, has zero external API dependencies for its core functions, and produces a clean text report I can drop straight into my notes.

This article covers what DMitry does, how it’s built, how to install and use every major flag, real command output, and how I combine it with other recon tools in a proper workflow — all against targets I’m authorized to test.

What DMitry Does

DMitry is a passive-to-light-active reconnaissance tool written in C. In a single binary it can:

• Perform whois lookups on a domain
• Perform whois lookups on an IP netblock
• Search for subdomains of a target domain
• Search for possible email addresses tied to a domain
• Grab information from Netcraft (historical hosting info)
• Perform a basic TCP port scan with banner grabbing

Architecture and Internal Working

DMitry is a single statically-compiled utility rather than a framework. Internally, it’s organized into independent modules, each triggered by its own command-line flag:

• The whois module issues a raw whois query to the appropriate registrar’s whois server based on TLD.
• The subdomain module uses simple DNS resolution attempts against a wordlist bundled in the tool combined with search-engine scraping (historically).
• The email harvesting module scrapes search engine results pages looking for @domain.com-style strings.
• The TCP port scan module opens raw TCP connect() calls against a configurable port range and grabs any banner text the service returns.

Because each module is independent, you can combine flags in a single run and DMitry executes each one sequentially, writing all results into one combined output if you use the -o flag.

Installation

Debian/Kali:

sudo apt update
sudo apt install dmitry -y

From source:

git clone https://github.com/jaygreig86/dmitry.git
cd dmitry
./configure
make
sudo make install

Verify:

dmitry -h

Basic Syntax

dmitry [options] host

Command Examples

1. Whois lookup on a domain

dmitry -w example.com

Sample output snippet:

Gathered Whois information for example.com
---------------------------------
Domain Name: EXAMPLE.COM
Registrar: RESERVED-INTERNET ASSIGNED NUMBERS AUTHORITY
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Name Server: A.IANA-SERVERS.NET
Name Server: B.IANA-SERVERS.NET

2. Subdomain enumeration

dmitry -s example.com

Output:

Gathered Subdomain information for example.com
------------------------------------
HostIP:93.184.216.34 Hostname:www.example.com
HostIP:93.184.216.35 Hostname:mail.example.com

3. Email address harvesting

dmitry -e example.com

Output:

Gathered E-Mail information for example.com
-----------------------------------
Searching Google.com:80..... 
Found 3 E-Mail(s) for host example.com, Searched 0 pages containing host name:
admin@example.com
info@example.com
support@example.com

4. TCP port scan with banner grab

dmitry -p example.com -f -b

• -p triggers a TCP port scan
• -f performs a filtered/full scan across the port list
• -b grabs service banners on open ports

Output:

Gathered TCP Port information for example.com
----------------------------------------
Port    State
21/tcp  filtered
22/tcp  open      SSH-2.0-OpenSSH_8.9p1
80/tcp  open      Apache/2.4.52 (Ubuntu)
443/tcp open

5. Netcraft-style historical info

dmitry -n example.com

6. Combine everything and save to a report file

dmitry -winsepo recon_example.txt example.com

This single command runs whois, subdomains, Netcraft info, email harvesting, and a port scan, all written to recon_example.txt.

Configuration Options

Real-World Use Cases

Initial OSINT phase of a pentest: I run a combined dmitry -winse scan first thing to build a baseline picture — registrar info, subdomains, and possible staff emails for later social-engineering-aware phishing simulations (within scope, of course).

Attack surface mapping: Subdomain output feeds directly into further tools like amass or httpx for live host validation.

Digital forensics timeline building: Netcraft historical data helps reconstruct what a domain’s hosting/infrastructure looked like at various points in time, useful when investigating a compromised or spoofed domain.

Email exposure assessment: Harvested addresses help a client understand how much of their staff directory is exposed to search engines, which feeds into a phishing-risk conversation.

Workflow and Tool Integration

# Step 1: broad passive recon
dmitry -winse -o dmitry_report example.com

# Step 2: pull subdomains out for validation
grep "Hostname:" dmitry_report.txt | awk -F"Hostname:" '{print $2}' > subdomains.txt

# Step 3: hand off to amass for deeper subdomain enumeration
amass enum -d example.com -o amass_report.txt

# Step 4: validate live hosts
cat subdomains.txt | httpx -silent -status-code

This kind of chaining is where DMitry earns its keep — it’s the fast first pass, not the final word.

Performance Optimization

• Use -t to lower the timeout when scanning against responsive infrastructure to speed up the full run.
• Skip -p (port scan) when you only need OSINT data — it’s the slowest module by far.
• Run DMitry output through grep/awk immediately rather than trying to parse it manually; the text format is consistent enough to script against.

Troubleshooting

• Email/subdomain search returns nothing — search-engine-scraping modules can be blocked or rate-limited by the search provider; this is a known limitation of an older tool relying on scraping rather than APIs.
• Whois returns “No match” — some registries (particularly ccTLDs) use different whois formats DMitry doesn’t fully parse; fall back to whois directly.
• Port scan hangs — reduce the timeout value with -t or scan a narrower port range with a modern tool like nmap instead for large ranges.

Best Practices and Common Mistakes

• Treat DMitry‘s email/subdomain results as a starting point, not ground truth — always corroborate with a second tool.
• Don’t rely on it as your only port scanner; it’s a simple TCP connect scanner without service/version detection depth.
• Save every run with -o so you have a timestamped record for your report.

FAQ

Is DMitry still maintained? It’s a stable, mature tool; development has slowed, but it remains in most Kali repositories and still functions well for its core use cases.

Does DMitry need an API key? No — that’s part of its appeal. Everything runs without needing search engine or whois API credentials.

Can DMitry replace amass or Sublist3r? Not entirely. It’s faster for a quick look but has a much smaller subdomain wordlist and less depth than dedicated enumeration tools.

Lab Example

In a lab, register a throwaway domain or use one you own, then run:

dmitry -winse -o lab_recon your-lab-domain.com
cat lab_recon.txt

Compare the subdomain and whois output against what you already know about the domain to build intuition for how accurate/incomplete the tool’s picture actually is.

Summary

DMitry is a lightweight, dependency-free OSINT Swiss Army knife that’s perfect for the first ten minutes of a reconnaissance phase. It won’t replace specialized tools for deep subdomain enumeration or full port scanning, but as a fast, single-command way to pull whois, subdomains, emails, and basic port/banner info, it earns a permanent spot in my toolkit.

References

• GitHub repository: https://github.com/jaygreig86/dmitry
• Man page: man dmitry