开发者社区> 毒逆天> 正文
阿里云
为了无法计算的价值
打开APP
阿里云APP内打开

★Kali信息收集~3.子域名系列

简介:
+关注继续查看

3.1Netcraft :子域名查询

 官网:http://searchdns.netcraft.com/

输入要查询的域名,即可得知子域名

   

 

3.2Fierce :子域名查询

  • 概述:

    fierce 是使用多种技术来扫描目标主机IP地址和主机名的一个DNS服务器枚举工具。运用递归的方式来工作。它的工作原理是先通过查询本地DNS服务器来查找目标DNS服务器,然后使用目标DNS服务器来查找子域名。fierce的主要特点就是可以用来定位独立IP空间对应域名和主机名。

       

  • 参数:

    root@Kali:/home/dnt# fierce -h

    fierce.pl (C) Copywrite 2006,2007 - By RSnake at http://ha.ckers.org/fierce/

       

    Usage: perl fierce.pl [-dns example.com] [OPTIONS]

       

    Overview:

    Fierce is a semi-lightweight scanner that helps locate non-contiguous

    IP space and hostnames against specified domains. It's really meant

    as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all

    of those require that you already know what IP space you are looking

    for. This does not perform exploitation and does not scan the whole

    internet indiscriminately. It is meant specifically to locate likely

    targets both inside and outside a corporate network. Because it uses

    DNS primarily you will often find mis-configured networks that leak

    internal address space. That's especially useful in targeted malware.

       

    Options:

    -connect        Attempt to make http connections to any non RFC1918

    (public) addresses. This will output the return headers but

    be warned, this could take a long time against a company with

    many targets, depending on network/machine lag. I wouldn't

    recommend doing this unless it's a small company or you have a

    lot of free time on your hands (could take hours-days).

    Inside the file specified the text "Host:\n" will be replaced

    by the host specified. Usage:

       

    perl fierce.pl -dns example.com -connect headers.txt

       

    -delay                The number of seconds to wait between lookups.

    -dns                The domain you would like scanned.

    -dnsfile         Use DNS servers provided by a file (one per line) for

    reverse lookups (brute force).

    -dnsserver        Use a particular DNS server for reverse lookups

    (probably should be the DNS server of the target). Fierce

    uses your DNS server for the initial SOA query and then uses

    the target's DNS server for all additional queries by default.

    -file                A file you would like to output to be logged to.

    -fulloutput        When combined with -connect this will output everything

    the webserver sends back, not just the HTTP headers.

    -help                This screen.

    -nopattern        Don't use a search pattern when looking for nearby

    hosts. Instead dump everything. This is really noisy but

    is useful for finding other domains that spammers might be

    using. It will also give you lots of false positives,

    especially on large domains.

    -range                Scan an internal IP range (must be combined with

    -dnsserver). Note, that this does not support a pattern

    and will simply output anything it finds. Usage:

       

    perl fierce.pl -range 111.222.333.0-255 -dnsserver ns1.example.co

       

    -search                Search list. When fierce attempts to traverse up and

    down ipspace it may encounter other servers within other

    domains that may belong to the same company. If you supply a

    comma delimited list to fierce it will report anything found.

    This is especially useful if the corporate servers are named

    different from the public facing website. Usage:

       

    perl fierce.pl -dns examplecompany.com -search corpcompany,blahcompany

       

    Note that using search could also greatly expand the number of

    hosts found, as it will continue to traverse once it locates

    servers that you specified in your search list. The more the

    better.

    -suppress        Suppress all TTY output (when combined with -file).

    -tcptimeout        Specify a different timeout (default 10 seconds). You

    may want to increase this if the DNS server you are querying

    is slow or has a lot of network lag.

    -threads Specify how many threads to use while scanning (default

    is single threaded).

    -traverse        Specify a number of IPs above and below whatever IP you

    have found to look for nearby IPs. Default is 5 above and

    below. Traverse will not move into other C blocks.

    -version        Output the version number.

    -wide                Scan the entire class C after finding any matching

    hostnames in that class C. This generates a lot more traffic

    but can uncover a lot more information.

    -wordlist        Use a seperate wordlist (one word per line). Usage:

       

    perl fierce.pl -dns examplecompany.com -wordlist dictionary.txt

       

  • 实例:threads 是线程数,可以自己指定

     root@Kali:/home/dnt# fierce -dns cnblogs.com -threads 100

       

    Trying zone transfer first...

       

    Unsuccessful in zone transfer (it was worth a shot)

    Okay, trying the good old fashioned way... brute force

       

    Checking for wildcard DNS...

    ** Found 99901599299.cnblogs.com at 42.121.252.58.

    ** High probability of wildcard DNS.

    Now performing 2280 test(s)...

    120.26.70.206        files.cnblogs.com

    42.121.129.234        images.cnblogs.com

    223.6.251.45        group.cnblogs.com

    223.6.251.45        home.cnblogs.com

    42.121.129.234        download.cnblogs.com

    221.181.200.235        cdn.cnblogs.com

    42.121.131.85        mail.cnblogs.com

    42.121.129.234        downloads.cnblogs.com

    223.6.251.45        news.cnblogs.com

    223.6.251.45        ad.cnblogs.com

    42.121.254.229        p.cnblogs.com

    。。。。。。。。

       

版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。

相关文章
高校大学生第一次使用ECS搭建Yapi
社区的小伙伴们,大家好!我是来自合肥工业大学信息与通信工程专业研究生二年级的一名学生。这次非常荣幸能够参加阿里云的“飞天加速计划-高校学生在家实践活动”。科研之余,我一直在学校自学前端开发,现在正在学习如何使用Yapi统一管理项目接口,想购买一台云服务器进行实际的一些操作,这样能更加有利于我了解前端开发过程的一个整体流程。所以在学习Yapi搭建的时候,我觉得如果能有一台服务器可以更加帮助自己学习项目开发的过程。在我对众多服务器开始进行了解的时候,一个朋友推荐我使用阿里云服务器,说是对在校大学生有个“飞天加速计划”可以免费试用,听到这个消息真的让我感到非常兴奋。于是,在朋友的推荐下,我加入...
19 0
ELK+Kafka搭建分布式日志收集系统
ELK+Kafka搭建分布式日志收集系统
30 0
基于ECS搭建LAMP环境
基于ECS实例快速搭建一套LAMP环境
83 0
SAP CRM,Cloud for Customer和Fiori应用的direct navigation比较
SAP CRM,Cloud for Customer和Fiori应用的direct navigation比较
45 0
ECS 搭建LAMP
LAMP环境搭建
838 0
+关注
毒逆天
目前不太用云栖, 博客园地址:http://dunitian.cnblogs.com;GitHub地址:https://github.com/dunitian
368
文章
0
问答
文章排行榜
最热
最新
相关电子书
更多
低代码开发师(初级)实战教程
立即下载
阿里巴巴DevOps 最佳实践手册
立即下载
冬季实战营第三期:MySQL数据库进阶实战
立即下载