What is DNSMap?
DNSMap is an open-source network reconnaissance tool designed to discover subdomains of a target domain. It is commonly used in penetration testing and security assessments to identify potential entry points or vulnerabilities within a domain’s infrastructure. DNSMap works by brute-forcing subdomains using a predefined wordlist or by performing dictionary-based attacks.
Key Features of DNSMap:
- Subdomain Discovery: It helps identify subdomains associated with a target domain.
- Wordlist-Based Brute-Forcing: Uses a built-in or custom wordlist to guess subdomains.
- Output Options: Results can be saved in human-readable or machine-readable formats.
- Lightweight and Fast: Designed to be efficient and easy to use.
How to Use DNSMap
Installation:
DNSMap is typically pre-installed on penetration testing distributions like Kali Linux. If not, you can install it manually:
- On Debian-based systems (e.g., Kali Linux, Ubuntu):
Bash
sudo apt update
sudo apt install dnsmap- On other systems, you can download and compile it from the source:
Bash
git clone https://github.com/makefu/dnsmap.git
cd dnsmap
make
sudo make installOptions:
-
-w:- Specifies a custom wordlist file for subdomain brute-forcing.
- If not provided, DNSMap uses its built-in wordlist.
-
-r:- Saves the results in a human-readable format to the specified file.
-
-c:- Saves the results in CSV format to the specified file.
-
-d:- Adds a delay (in milliseconds) between DNS queries to avoid detection or rate-limiting.
-
-i:- Ignores specific IP addresses in the results (useful to avoid false positives).
Examples
- Basic Scan:
- Scan
example.comusing the default wordlist:
Bash
dnsmap example.com
┌──(komugi㉿komugi)-[~]
└─$ dnsmap github.com
dnsmap 0.36 - DNS Network Mapper
[+] searching (sub)domains for github.com using built-in wordlist
[+] using maximum random delay of 10 millisecond(s) between requests
admin.github.com
IP address #1: 140.82.112.23
blog.github.com
IPv6 address #1: 2606:50c0:8000::153
IPv6 address #2: 2606:50c0:8002::153
IPv6 address #3: 2606:50c0:8003::153
IPv6 address #4: 2606:50c0:8001::153
blog.github.com
IP address #1: 185.199.109.153
IP address #2: 185.199.108.153
IP address #3: 185.199.111.153
IP address #4: 185.199.110.153
classroom.github.com
IP address #1: 140.82.113.21
cs.github.com
IP address #1: 140.82.112.18
de.github.com
IP address #1: 140.82.112.18-
Custom Wordlist:
- Scan
example.comusing a custom wordlist (yourwordlist.txt) and save results to/tmp/domainbf_results.txt:dnsmap example.com -w yourwordlist.txt -r /tmp/domainbf_results.txt
- Scan
-
Add Delay Between Queries:
- Scan
example.comwith a 3-second delay between queries and save results to/tmp/:dnsmap example.com -r /tmp/ -d 3000
- Scan
-
Save Results in Current Directory:
- Scan
example.comand save results to./domainbf_results.txt:dnsmap example.com -r ./domainbf_results.txt
- Scan
-
Ignore Specific IPs:
- Scan
example.comand ignore specific IP addresses (e.g.,192.168.1.1and10.0.0.1):dnsmap example.com -i 192.168.1.1,10.0.0.1
- Scan
Tips for Using DNSMap Effectively
- Custom Wordlists: Use tailored wordlists for better results, especially for specific industries or technologies.
- Delay Option: Use the
-doption to avoid triggering rate limits or detection mechanisms. - Output Formats: Use
-rfor human-readable results and-cfor machine-readable CSV output. - False Positives: Use the
-ioption to ignore IPs that may cause false positives.
Important Notes
- Legal Use: Always ensure you have explicit permission to scan the target domain. Unauthorized scanning is illegal and unethical.
- Combine with Other Tools: Use DNSMap alongside tools like
Sublist3r,Amass, orAssetfinderfor comprehensive subdomain enumeration.
DNSMap is a lightweight and efficient tool for subdomain discovery, making it a valuable asset for penetration testers and security professionals.
