← All cheat sheets

🌶 DNSRECON

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

dnsrecon is a powerful DNS enumeration and reconnaissance tool written
in Python. It performs zone transfers, brute force, SRV record
enumeration, Google lookup, and cache snooping.

dnsrecon -d <domain>             # Standard DNS enumeration
dnsrecon -d <domain> -a          # Perform zone transfer
dnsrecon -d <domain> -t std      # Standard record enumeration

dnsrecon -d <domain> -t std      # SOA, NS, A, AAAA, MX, SRV records
dnsrecon -d <domain> -t rvl      # Reverse lookup of IP range
dnsrecon -d <domain> -t brt      # Brute force subdomains
dnsrecon -d <domain> -t srv      # SRV record enumeration
dnsrecon -d <domain> -t axfr     # Zone transfer
dnsrecon -d <domain> -t bing     # Bing search for subdomains
dnsrecon -d <domain> -t yand     # Yandex search for subdomains
dnsrecon -d <domain> -t crt      # Certificate transparency lookup
dnsrecon -d <domain> -t snoop    # DNS cache snooping
dnsrecon -d <domain> -t tld      # TLD expansion
dnsrecon -d <domain> -t zonewalk # DNSSEC zone walking

dnsrecon -d <domain> -t brt -D /path/wordlist.txt
                                 # Brute force with wordlist
dnsrecon -d <domain> -t brt --threads 10
                                 # Threaded brute force
dnsrecon -d <domain> -t brt -f   # Filter wildcard records
dnsrecon -d <domain> -t brt --iw # Continue on wildcard detection

dnsrecon -r 192.168.1.0/24       # Reverse lookup on CIDR range
dnsrecon -r 192.168.1.1-192.168.1.50
                                 # Reverse lookup on IP range

dnsrecon -d <domain> -n 8.8.8.8  # Use specific nameserver
dnsrecon -d <domain> --tcp       # Use TCP for queries

dnsrecon -t snoop -n <ns_server> -D /path/domains.txt
                                 # Check if NS has cached domains

dnsrecon -d <domain> -t zonewalk # Walk DNSSEC-enabled zone (NSEC)

dnsrecon -d <domain> --xml out.xml    # XML output
dnsrecon -d <domain> --json out.json  # JSON output
dnsrecon -d <domain> --csv out.csv    # CSV output
dnsrecon -d <domain> --db out.db      # SQLite database output
dnsrecon -d <domain> -c out.csv       # CSV output (alt)

# Full enumeration with brute force and output
dnsrecon -d example.com -t std,brt -D /usr/share/wordlists/dns.txt --json results.json

# Zone transfer with specific nameserver
dnsrecon -d example.com -t axfr -n ns1.example.com

# DNSSEC zone walking
dnsrecon -d example.com -t zonewalk --json zone_records.json

# Reverse lookup of a /24 subnet
dnsrecon -r 10.0.0.0/24 --csv reverse_results.csv

# Cache snooping against DNS server
dnsrecon -t snoop -n 10.0.0.1 -D /usr/share/seclists/Discovery/DNS/top-1000.txt

# Certificate transparency + standard enum
dnsrecon -d example.com -t std,crt

/usr/share/dnsrecon/namelist.txt          # Default wordlist
/usr/share/seclists/Discovery/DNS/        # SecLists DNS wordlists
/usr/share/wordlists/dnsmap.txt           # Alternative wordlist

- Supports DNSSEC zone walking (NSEC/NSEC3)
- Can detect wildcard DNS entries
- Certificate transparency provides passive subdomain discovery
- Database output allows later querying with SQL
- Use --threads to speed up brute force scans