NAME

       dnsmap - scan for subdomains using bruteforcing techniques

SYNOPSIS

       dnsmap <target-domain> [options]

DESCRIPTION

       dnsmap  scans  a domain for common subdomains using a built-in or an external wordlist (if
       specified with -w option). The internal wordlist has around  1000  words  in  English  and
       Spanish   as   ns1,  firewall,  servicios  and  smtp.  So  will  be  possible  search  for
       smtp.example.com inside example.com automatically.  Results can be saved in CSV and human-
       readable format for further processing. dnsmap does NOT require root privileges to be run,
       and should NOT be run with such privileges for security reasons.

       dnsmap was originally released back in 2006 and was inspired by the fictional  story  "The
       Thief  No  One  Saw" by Paul Craig, which can be found in the book "Stealing the Network -
       How to 0wn the Box".

       dnsmap  is  mainly   meant   to   be   used   by   pentesters   during   the   information
       gathering/enumeration phase of infrastructure security assessments. During the enumeration
       stage, the security consultant would typically discover the target company's IP netblocks,
       domain names, phone numbers, etc.

       Subdomain  bruteforcing is another technique that should be used in the enumeration stage,
       as it's especially useful when other domain enumeration techniques such as zone  transfers
       don't work (is rare to see zone transfers being publicly allowed these days by the way).

       Fun things that can happen:

              1.  Finding interesting remote access servers (e.g.: https://extranet.example.com).

              2.  Finding badly configured and/or unpatched servers (e.g.: test.example.com).

              3.  Finding  new  domain names which will allow you to map non-obvious/hard-to-find
                  netblocks of your target organization (registry lookups -  aka  whois  is  your
                  friend).

              4.  Sometimes  you  find  that  some  bruteforced subdomains resolve to internal IP
                  addresses (RFC 1918).  This is great as sometimes they are real up-to-date  "A"
                  records  which  means  that it *is* possible to enumerate internal servers of a
                  target organization from the Internet by only using standard DNS resolving  (as
                  opposed to zone transfers for instance).

              5.  Discover  embedded  devices  configured  using  Dynamic  DNS services (e.g.: IP
                  Cameras). This method is an alternative to finding devices via  Google  hacking
                  techniques.

OPTIONS

       -w <wordlist-file>
              Use  an  external  wordlist  instead  of  the built-in one. You can use programs as
              crunch or cupp to generate personalized wordlists.

       -r <regular-results-file>
              Save results to a plain text file. If a  file  name  isn't  supplied,  dnsmap  will
              create   an   unique   filename   which   includes  the  current  timestamp.  e.g.:
              dnsmap_example_com_br_2019_11_15_214812.txt. So, you can provide a  directory  name
              only, as -r /tmp.

       -c <csv-results-file>
              Save  results  in  CSV format in a file. If a file name isn't provided, dnsmap will
              create something as dnsmap_example_com_br_2019_11_15_220114.csv. This is a  similar
              behaviour from -r option.

       -d <delay-millisecs>
              Limit  of random delay in milliseconds between successive queries. Delay value is a
              maximum random value. e.g. if you enter 1000, each DNS request will  be  delayed  a
              *maximum*  of  1  second.  By  default,  dnsmap  uses a value of 10 milliseconds of
              maximum delay between DNS lookups. It is  recommended  to  use  the  -d  (delay  in
              milliseconds)  option  in  cases  where  dnsmap  is  interfering  with  your online
              experience. i.e.: killing your bandwidth. If used, delay  must  be  between  1  and
              300000 milliseconds (5 minutes).

       -i <ips-to-ignore>
              IP  addresses  to  ignore  in  the  results  (useful  if  you  get  obtaining false
              positives). Use commas without spaces to separate the  IP  addresses.  The  maximum
              number of IPs to filter is 5. Example: 203.0.113.10,198.51.199.65

INTERNAL WORDLIST

       The built-in wordlist is defined in src/dnsmap.h file. If needed, see the file to know all
       words.

EXAMPLES

       Subdomain bruteforcing using dnsmap's built-in wordlist:

           $ dnsmap example.com

       Subdomain bruteforcing using a user-supplied wordlist:

           $ dnsmap example.com -w wordlist.txt

       Subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/ :

           $ dnsmap example.com -r /tmp

       Example of subdomain bruteforcing using the  built-in  wordlist,  saving  the  results  to
       /tmp/, and waiting a random maximum of 300 milliseconds between each request:

           $ dnsmap example.com -r /tmp/ -d 300

       Subdomain  bruteforcing  with 0.8 seconds delay, saving results in regular and CSV format,
       filtering 2 user-provided IP and using a user-supplied wordlist:

           $ dnsmap example.com -d 800 -r /tmp/ -c /tmp/ -i 10.55.206.154,10.55.24.100 -w ./wordlist_TLAs.txt

BUGS

       Currently, dnsmap does not yet support parallel scanning and hence take quite a long time.

       New   bugs   should   be    reported    at    https://github.com/resurrecting-open-source-
       projects/dnsmap/issues

SEE ALSO

       crunch(1), cupp(1), dnsmap-bulk(1)

AUTHOR

       dnsmap  was  originally  written  by  "pagvac"  in  2006.  Currently  it  is maintained by
       volunteers,  inside  dnsmap   project,   at   https://github.com/resurrecting-open-source-
       projects/dnsmap/

       This manpage was written by Joao Eriberto Mota Filho.