Reconnaissance

Fierce

DNS reconnaissance tool for locating non-contiguous IP space.

beginner

Linux

Reconnaissance

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Finding related network blocks for an organization.

Run against domain; follow discovered ranges carefully within scope.

Scope expansion discovery (always confirm RoE).

Commands & usage

fierce --domain example.com

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

dnsrecon / dnsenum

DNS enumeration scripts for records, zone transfers, and brute force.

massdns

High-performance DNS stub resolver for bulk lookups.

puredns

Fast domain resolver and subdomain bruteforcing with wildcard filtering.