Long before I run an active scan against anything, I want a passive picture of the target — whois data, subdomains, open ports observed from a TCP grab, and any email addresses that might be floating around public sources. DMitry, short for Deepmagic Information Gathering Tool, is one of the older but still genuinely useful all-in-one OSINT utilities that bundles several of those lookups into a single command. I still reach for it early in engagements because it’s fast, has zero external API dependencies for its core functions, and produces a clean text report I can drop straight into my notes.
This article covers what DMitry does, how it’s built, how to install and use every major flag, real command output, and how I combine it with other recon tools in a proper workflow — all against targets I’m authorized to test.
What DMitry Does
DMitry is a passive-to-light-active reconnaissance tool written in C. In a single binary it can:
- Perform whois lookups on a domain
- Perform whois lookups on an IP netblock
- Search for subdomains of a target domain
- Search for possible email addresses tied to a domain
- Grab information from Netcraft (historical hosting info)
- Perform a basic TCP port scan with banner grabbing
Architecture and Internal Working
DMitry is a single statically-compiled utility rather than a framework. Internally, it’s organized into independent modules, each triggered by its own command-line flag:
- The whois module issues a raw whois query to the appropriate registrar’s whois server based on TLD.
- The subdomain module uses simple DNS resolution attempts against a wordlist bundled in the tool combined with search-engine scraping (historically).
- The email harvesting module scrapes search engine results pages looking for
@domain.com-style strings. - The TCP port scan module opens raw TCP connect() calls against a configurable port range and grabs any banner text the service returns.
Because each module is independent, you can combine flags in a single run and DMitry executes each one sequentially, writing all results into one combined output if you use the -o flag.
Installation
Debian/Kali:
sudo apt update
sudo apt install dmitry -y
From source:
git clone https://github.com/jaygreig86/dmitry.git
cd dmitry
./configure
make
sudo make install
Verify:
dmitry -h
Basic Syntax
dmitry [options] host
Command Examples
1. Whois lookup on a domain
dmitry -w example.com
Sample output snippet:
Gathered Whois information for example.com
---------------------------------
Domain Name: EXAMPLE.COM
Registrar: RESERVED-INTERNET ASSIGNED NUMBERS AUTHORITY
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Name Server: A.IANA-SERVERS.NET
Name Server: B.IANA-SERVERS.NET
2. Subdomain enumeration
dmitry -s example.com
Output:
Gathered Subdomain information for example.com
------------------------------------
HostIP:93.184.216.34 Hostname:www.example.com
HostIP:93.184.216.35 Hostname:mail.example.com
3. Email address harvesting
dmitry -e example.com
Output:
Gathered E-Mail information for example.com
-----------------------------------
Searching Google.com:80.....
Found 3 E-Mail(s) for host example.com, Searched 0 pages containing host name:
admin@example.com
info@example.com
support@example.com
4. TCP port scan with banner grab
dmitry -p example.com -f -b
-ptriggers a TCP port scan-fperforms a filtered/full scan across the port list-bgrabs service banners on open ports
Output:
Gathered TCP Port information for example.com
----------------------------------------
Port State
21/tcp filtered
22/tcp open SSH-2.0-OpenSSH_8.9p1
80/tcp open Apache/2.4.52 (Ubuntu)
443/tcp open
5. Netcraft-style historical info
dmitry -n example.com
6. Combine everything and save to a report file
dmitry -winsepo recon_example.txt example.com
This single command runs whois, subdomains, Netcraft info, email harvesting, and a port scan, all written to recon_example.txt.
Configuration Options
| Flag | Purpose |
|---|---|
-o <file> | Save output to file (also auto-appends .txt) |
-i | Perform whois on the IP of the host |
-w | Domain whois lookup |
-n | Netcraft.com info |
-s | Subdomain search |
-e | Email address search |
-p | TCP port scan |
-f | Perform a full/filtered port scan (used with -p) |
-b | Read/grab banner during port scan |
-t <0-9> | Set scan timeout value |
Real-World Use Cases
Initial OSINT phase of a pentest: I run a combined dmitry -winse scan first thing to build a baseline picture — registrar info, subdomains, and possible staff emails for later social-engineering-aware phishing simulations (within scope, of course).
Attack surface mapping: Subdomain output feeds directly into further tools like amass or httpx for live host validation.
Digital forensics timeline building: Netcraft historical data helps reconstruct what a domain’s hosting/infrastructure looked like at various points in time, useful when investigating a compromised or spoofed domain.
Email exposure assessment: Harvested addresses help a client understand how much of their staff directory is exposed to search engines, which feeds into a phishing-risk conversation.
Workflow and Tool Integration
# Step 1: broad passive recon
dmitry -winse -o dmitry_report example.com
# Step 2: pull subdomains out for validation
grep "Hostname:" dmitry_report.txt | awk -F"Hostname:" '{print $2}' > subdomains.txt
# Step 3: hand off to amass for deeper subdomain enumeration
amass enum -d example.com -o amass_report.txt
# Step 4: validate live hosts
cat subdomains.txt | httpx -silent -status-code
This kind of chaining is where DMitry earns its keep — it’s the fast first pass, not the final word.
Performance Optimization
- Use
-tto lower the timeout when scanning against responsive infrastructure to speed up the full run. - Skip
-p(port scan) when you only need OSINT data — it’s the slowest module by far. - Run
DMitryoutput throughgrep/awkimmediately rather than trying to parse it manually; the text format is consistent enough to script against.
Troubleshooting
- Email/subdomain search returns nothing — search-engine-scraping modules can be blocked or rate-limited by the search provider; this is a known limitation of an older tool relying on scraping rather than APIs.
- Whois returns “No match” — some registries (particularly ccTLDs) use different whois formats DMitry doesn’t fully parse; fall back to
whoisdirectly. - Port scan hangs — reduce the timeout value with
-tor scan a narrower port range with a modern tool likenmapinstead for large ranges.
Best Practices and Common Mistakes
- Treat
DMitry‘s email/subdomain results as a starting point, not ground truth — always corroborate with a second tool. - Don’t rely on it as your only port scanner; it’s a simple TCP connect scanner without service/version detection depth.
- Save every run with
-oso you have a timestamped record for your report.
FAQ
Is DMitry still maintained? It’s a stable, mature tool; development has slowed, but it remains in most Kali repositories and still functions well for its core use cases.
Does DMitry need an API key? No — that’s part of its appeal. Everything runs without needing search engine or whois API credentials.
Can DMitry replace amass or Sublist3r? Not entirely. It’s faster for a quick look but has a much smaller subdomain wordlist and less depth than dedicated enumeration tools.
Lab Example
In a lab, register a throwaway domain or use one you own, then run:
dmitry -winse -o lab_recon your-lab-domain.com
cat lab_recon.txt
Compare the subdomain and whois output against what you already know about the domain to build intuition for how accurate/incomplete the tool’s picture actually is.
Summary
DMitry is a lightweight, dependency-free OSINT Swiss Army knife that’s perfect for the first ten minutes of a reconnaissance phase. It won’t replace specialized tools for deep subdomain enumeration or full port scanning, but as a fast, single-command way to pull whois, subdomains, emails, and basic port/banner info, it earns a permanent spot in my toolkit.
References
- GitHub repository: https://github.com/jaygreig86/dmitry
- Man page:
man dmitry