Offensive Security Researcher & Quantum Cryptography Analyst

fierce: DNS reconnaissance tool for locating non-contiguous IP space

Abdul Wahab Junaid
fierce: DNS reconnaissance tool for locating non-contiguous IP space

fierce is a Python-based semi-active reconnaissance tool originally created by RSnake (Robert Hansen) and later rewritten in Python 3, maintained today as part of the Kali Linux toolset. Unlike a brute-force-heavy scanner, Fierce is designed to be a lightweight “first pass” DNS reconnaissance tool: it attempts a zone transfer, and if that fails, it performs targeted brute forcing against common subdomains while also scanning nearby/non-contiguous IP space that may belong to the same organization. It is especially useful for locating internal or non-public-facing hosts that share netblocks with a known target domain.

Installation

fierce is pre-installed on Kali Linux. Manual install elsewhere:

# Kali/Debian
sudo apt update && sudo apt install fierce -y

# Via pip (any Python 3 environment)
pip3 install fierce --break-system-packages

# From source
git clone https://github.com/mschwager/fierce.git
cd fierce
pip3 install -r requirements.txt --break-system-packages

Verify installation:

fierce --help

Syntax

fierce --domain DOMAIN [OPTIONS]

Command-Line Options

FlagDescription
--domain, -dns DOMAINTarget domain to scan (required)
--dns-servers SERVER [SERVER ...]Use specific DNS server(s) for queries instead of the system default
--subdomains SUBDOMAIN [SUBDOMAIN ...]Specify a custom, space-separated list of subdomains to test
--subdomain-file FILEProvide a wordlist file of subdomains to brute force
--wideScan the entire subnet (Class C, /24) of any discovered IP address for other hosts
--traverse NUMScan NUM IPs above and below each discovered IP address for other live hosts
--search DOMAIN [DOMAIN ...]Search for other domains that share IP space with the target
--range START ENDScan a specific custom IP range instead of relying on --wide/--traverse
--delay SECDelay in seconds between lookup requests (throttling)
--tcpUse TCP instead of UDP for DNS lookups
--nameserversJust perform a nameserver lookup and exit
--connectAttempt HTTP connections to discovered hosts to grab page titles/banners
--http-timeout SECTimeout in seconds for --connect HTTP requests

Basic Usage

fierce --domain example.com

Expected output:

NS: a.iana-servers.net. b.iana-servers.net.
SOA: a.iana-servers.net. (could not resolve)
Zone: failure
Wildcard: not detected
Found: example.com. (93.184.216.34)
Nearby:
   93.184.216.33  ??? (no PTR record)
   93.184.216.34  example.com
   93.184.216.35  ??? (no PTR record)

Practical Examples

Example 1 — Basic scan against a domain

fierce --domain example.com

NS: a.iana-servers.net. b.iana-servers.net.
Zone: failure
Found: example.com. (93.184.216.34)

Example 2 — Using a specific DNS server

fierce --domain example.com --dns-servers 8.8.8.8

NS: a.iana-servers.net. b.iana-servers.net.
Found: example.com. (93.184.216.34)

Example 3 — Brute forcing with a custom subdomain wordlist

fierce --domain example.com --subdomain-file /usr/share/wordlists/dnsmap.txt

Found: www.example.com. (93.184.216.34)
Found: mail.example.com. (93.184.216.35)
Found: ftp.example.com. (93.184.216.36)

Example 4 — Testing a specific short list of subdomains

fierce --domain example.com --subdomains www mail vpn admin

Found: www.example.com. (93.184.216.34)
Found: vpn.example.com. (93.184.216.38)

Example 5 — Wide netblock scan around discovered hosts

fierce --domain example.com --wide

Found: example.com. (93.184.216.34)
Nearby:
   93.184.216.1   gw.example.com
   93.184.216.34  example.com
   93.184.216.90  internal-vpn.example.com

Example 6 — Traverse a fixed number of neighboring IPs

fierce --domain example.com --traverse 10

Found: example.com. (93.184.216.34)
Nearby:
   93.184.216.24  (no PTR)
   93.184.216.44  backup.example.com

Example 7 — Search for sibling domains sharing IP space

fierce --domain example.com --search example-corp.com example-inc.com

Found: example.com. (93.184.216.34)
Found other domains on same IP space:
   example-corp.com

Example 8 — Connect to discovered hosts and grab HTTP titles

fierce --domain example.com --subdomain-file /usr/share/wordlists/dnsmap.txt --connect

Found: www.example.com. (93.184.216.34) - "Example Domain"
Found: admin.example.com. (93.184.216.39) - "Login - Admin Panel"

Common Use Cases

Automation with Bash

Run Fierce across multiple domains and log results:

#!/bin/bash
# fierce_batch.sh
mkdir -p fierce_results
while IFS= read -r domain; do
    echo "[*] Fierce scanning $domain"
    fierce --domain "$domain" --subdomain-file /usr/share/wordlists/dnsmap.txt \
        > "fierce_results/${domain}.txt" 2>&1
done < domains.txt

Combine with --connect to quickly flag interesting HTTP titles across all results:

#!/bin/bash
grep -h '"' fierce_results/*.txt | sort -u

Tips and Best Practices

Troubleshooting

ProblemCauseFix
Wildcard: found warningDomain uses wildcard DNS, causing false-positive subdomain “found” resultsManually verify each found subdomain with dig; treat wildcard domains’ brute-force results with skepticism
No nearby hosts found with --wide/--traverseTarget’s IP is inside a shared cloud provider block with no other target-owned hosts nearbyExpected on cloud-hosted targets (AWS/Azure/GCP) — pivot to subdomain enumeration tools instead
Slow performance on large wordlistsNo built-in multithreading tuning exposed via CLI in older versionsSplit large wordlists into smaller chunks and run in parallel background jobs
--connect times out on many hostsHosts have HTTP(S) blocked or filtered by firewallIncrease --http-timeout; verify connectivity independently with curl

References

Exit mobile version