Script dns-brute
Script types:
prerule, hostrule
Categories:
intrusive, discovery
Download: https://svn.nmap.org/nmap/scripts/dns-brute.nse
Script Summary
Attempts to enumerate DNS hostnames by brute force guessing of common
subdomains. With the dns-brute.srv argument, dns-brute will also
try to enumerate common DNS SRV records.
Wildcard records are listed as "*A" and "*AAAA" for IPv4 and IPv6 respectively.
See also:
Script Arguments
- dns-brute.threads
Thread to use (default 5).
- dns-brute.srvlist
The filename of a list of SRV records to try. Defaults to "nselib/data/dns-srv-names"
- dns-brute.hostlist
The filename of a list of host strings to try. Defaults to "nselib/data/vhosts-default.lst"
- dns-brute.srv
Perform lookup for SRV records
- dns-brute.domain
Domain name to brute force if no host is specified
- max-newtargets, newtargets
See the documentation for the target library.
Example Usage
nmap --script dns-brute --script-args dns-brute.domain=foo.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sS -p 80 nmap --script dns-brute www.foo.com
Script Output
Pre-scan script results: | dns-brute: | DNS Brute-force hostnames | www.foo.com - 127.0.0.1 | mail.foo.com - 127.0.0.2 | blog.foo.com - 127.0.1.3 | ns1.foo.com - 127.0.0.4 | admin.foo.com - 127.0.0.5 |_ *A: 127.0.0.123
Requires
Author:
License: Same as Nmap--See https://nmap.org/book/man-legal.html