fierce is a Python-based semi-active reconnaissance tool originally created by RSnake (Robert Hansen) and later rewritten in Python 3, maintained today as part of the Kali Linux toolset. Unlike a brute-force-heavy scanner, Fierce is designed to be a lightweight “first pass” DNS reconnaissance tool: it attempts a zone transfer, and if that fails, it performs targeted brute forcing against common subdomains while also scanning nearby/non-contiguous IP space that may belong to the same organization. It is especially useful for locating internal or non-public-facing hosts that share netblocks with a known target domain.
Installation
fierce is pre-installed on Kali Linux. Manual install elsewhere:
# Kali/Debian
sudo apt update && sudo apt install fierce -y
# Via pip (any Python 3 environment)
pip3 install fierce --break-system-packages
# From source
git clone https://github.com/mschwager/fierce.git
cd fierce
pip3 install -r requirements.txt --break-system-packages
Verify installation:
fierce --help
Syntax
fierce --domain DOMAIN [OPTIONS]
Command-Line Options
| Flag | Description |
|---|---|
--domain, -dns DOMAIN | Target domain to scan (required) |
--dns-servers SERVER [SERVER ...] | Use specific DNS server(s) for queries instead of the system default |
--subdomains SUBDOMAIN [SUBDOMAIN ...] | Specify a custom, space-separated list of subdomains to test |
--subdomain-file FILE | Provide a wordlist file of subdomains to brute force |
--wide | Scan the entire subnet (Class C, /24) of any discovered IP address for other hosts |
--traverse NUM | Scan NUM IPs above and below each discovered IP address for other live hosts |
--search DOMAIN [DOMAIN ...] | Search for other domains that share IP space with the target |
--range START END | Scan a specific custom IP range instead of relying on --wide/--traverse |
--delay SEC | Delay in seconds between lookup requests (throttling) |
--tcp | Use TCP instead of UDP for DNS lookups |
--nameservers | Just perform a nameserver lookup and exit |
--connect | Attempt HTTP connections to discovered hosts to grab page titles/banners |
--http-timeout SEC | Timeout in seconds for --connect HTTP requests |
Basic Usage
fierce --domain example.com
Expected output:
NS: a.iana-servers.net. b.iana-servers.net.
SOA: a.iana-servers.net. (could not resolve)
Zone: failure
Wildcard: not detected
Found: example.com. (93.184.216.34)
Nearby:
93.184.216.33 ??? (no PTR record)
93.184.216.34 example.com
93.184.216.35 ??? (no PTR record)
Practical Examples
Example 1 — Basic scan against a domain
fierce --domain example.com
NS: a.iana-servers.net. b.iana-servers.net.
Zone: failure
Found: example.com. (93.184.216.34)
Example 2 — Using a specific DNS server
fierce --domain example.com --dns-servers 8.8.8.8
NS: a.iana-servers.net. b.iana-servers.net.
Found: example.com. (93.184.216.34)
Example 3 — Brute forcing with a custom subdomain wordlist
fierce --domain example.com --subdomain-file /usr/share/wordlists/dnsmap.txt
Found: www.example.com. (93.184.216.34)
Found: mail.example.com. (93.184.216.35)
Found: ftp.example.com. (93.184.216.36)
Example 4 — Testing a specific short list of subdomains
fierce --domain example.com --subdomains www mail vpn admin
Found: www.example.com. (93.184.216.34)
Found: vpn.example.com. (93.184.216.38)
Example 5 — Wide netblock scan around discovered hosts
fierce --domain example.com --wide
Found: example.com. (93.184.216.34)
Nearby:
93.184.216.1 gw.example.com
93.184.216.34 example.com
93.184.216.90 internal-vpn.example.com
Example 6 — Traverse a fixed number of neighboring IPs
fierce --domain example.com --traverse 10
Found: example.com. (93.184.216.34)
Nearby:
93.184.216.24 (no PTR)
93.184.216.44 backup.example.com
Example 7 — Search for sibling domains sharing IP space
fierce --domain example.com --search example-corp.com example-inc.com
Found: example.com. (93.184.216.34)
Found other domains on same IP space:
example-corp.com
Example 8 — Connect to discovered hosts and grab HTTP titles
fierce --domain example.com --subdomain-file /usr/share/wordlists/dnsmap.txt --connect
Found: www.example.com. (93.184.216.34) - "Example Domain"
Found: admin.example.com. (93.184.216.39) - "Login - Admin Panel"
Common Use Cases
- Quick zone-transfer check plus a lightweight subdomain sweep as an early-stage recon step before running heavier tools like Amass.
- Discovering internal/non-indexed hosts by scanning IP space adjacent to publicly known servers (
--wide/--traverse). - Identifying other domains that share hosting infrastructure with the target (
--search), useful for expanding scope during bug bounty or infrastructure mapping. - Grabbing quick HTTP titles from discovered hosts (
--connect) to prioritize interesting targets (e.g., admin panels, login pages).
Automation with Bash
Run Fierce across multiple domains and log results:
#!/bin/bash
# fierce_batch.sh
mkdir -p fierce_results
while IFS= read -r domain; do
echo "[*] Fierce scanning $domain"
fierce --domain "$domain" --subdomain-file /usr/share/wordlists/dnsmap.txt \
> "fierce_results/${domain}.txt" 2>&1
done < domains.txt
Combine with --connect to quickly flag interesting HTTP titles across all results:
#!/bin/bash
grep -h '"' fierce_results/*.txt | sort -u
Tips and Best Practices
- Run Fierce early in an engagement — it’s fast and gives a quick sense of whether zone transfers are possible and whether the domain uses wildcard DNS.
- Use
--widecautiously against large hosting providers/CDNs (e.g., Cloudflare, AWS) — scanning an entire /24 there will mostly return unrelated third-party hosts, not target infrastructure. - Combine Fierce’s initial findings with Amass or Subfinder for deeper subdomain enumeration; Fierce is meant to be a fast first-pass tool, not an exhaustive one.
- Always add
--delaywhen scanning against sensitive or rate-limited DNS infrastructure to avoid triggering alerts or being blocked.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
Wildcard: found warning | Domain uses wildcard DNS, causing false-positive subdomain “found” results | Manually verify each found subdomain with dig; treat wildcard domains’ brute-force results with skepticism |
No nearby hosts found with --wide/--traverse | Target’s IP is inside a shared cloud provider block with no other target-owned hosts nearby | Expected on cloud-hosted targets (AWS/Azure/GCP) — pivot to subdomain enumeration tools instead |
| Slow performance on large wordlists | No built-in multithreading tuning exposed via CLI in older versions | Split large wordlists into smaller chunks and run in parallel background jobs |
--connect times out on many hosts | Hosts have HTTP(S) blocked or filtered by firewall | Increase --http-timeout; verify connectivity independently with curl |
References
- Official GitHub repository: https://github.com/mschwager/fierce
- Kali Linux tool page: https://www.kali.org/tools/fierce/
- Original Fierce Perl tool history (RSnake): https://web.archive.org/web/2008*/ha.ckers.org/fierce/
