Reconnaissance

dnsrecon / dnsenum

DNS enumeration scripts for records, zone transfers, and brute force.

beginner

Linux

Reconnaissance

Enumeration

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Deepening DNS recon beyond dig one-liners.

Standard record enum; attempt AXFR; brute subdomains.

DNS misconfigs still appear in real assessments.

Commands & usage

dnsrecon -d example.com

dnsrecon -d example.com -t axfr

dnsenum example.com

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Fierce

DNS reconnaissance tool for locating non-contiguous IP space.

massdns

High-performance DNS stub resolver for bulk lookups.

puredns

Fast domain resolver and subdomain bruteforcing with wildcard filtering.