DNSRecon Cheat Sheet

Basic

dnsrecon -d example.com

Brute force subdomains

dnsrecon -d example.com -t brt

Save the results to SQLite format

dnsrecon -d example.com --db /path/to/sqllite.file

Brute force subdomains with a wordlist

dnsrecon -d example.com -t brt -w wordlist.txt

Brute force subdomains with a wordlist and threads

dnsrecon -d example.com -t brt -w wordlist.txt -T 10

Brute force subdomains with a wordlist and threads and save to file

dnsrecon -d example.com -t brt -w wordlist.txt -T 10 -z -v -j /tmp/dnsrecon.json

DNS Zone Transfer

dnsrecon -d example.com -t axfr

Cache snooping

dnsrecon -t snoop -n ns_server -d example.com -D /path/to/dict.txt

Zone walking

dnsrecon -d example.com -t zonewalk

Brute-forcing

dnsrecon -d example.com -t brt

Brute-forcing with dictionary

dnsrecon -d example.com -t brt -D /path/to/dict.txt

Reverse lookup

dnsrecon -r 208.67.222.200-208.67.222.255 -d example.com