GO KALI FREE

DNSRecon

Information Gathering

Beginnermedium risk

DNSRecon provides the ability to check NS records, MX records, zone transfers, SRV records, and cache snooping capabilities within a comprehensive Python network inspection script environment.

Installation

sudo apt install dnsrecon

Basic Syntax

dnsrecon -d <domain>

Quick Facts

Full Name
DNSRecon
License
GPLv2
Author
Carlos Perez (darkoperator)
Written In
Python
Platforms
Linux, macOS, Windows
Category
DNS Enumeration
First Release
2007
Root Required
No

Tool Overview

DNSRecon is a comprehensive DNS enumeration tool that performs zone transfers, DNS record enumeration, brute-forcing, reverse DNS lookups, and cache snooping. Written in Python, it provides a complete DNS audit of target domains.

Created by Carlos Perez in 2007, DNSRecon is one of the most feature-rich DNS enumeration tools available. It supports checking for misconfigured DNS servers that allow zone transfers, which can reveal the entire DNS database in a single request.

The tool supports multiple enumeration modes including standard record checking, dictionary-based brute-forcing, zone transfer attempts, and reverse DNS lookups across IP ranges. Results can be saved in multiple formats for later analysis.

Common Commands

dnsrecon -d example.com -t stdStandard check - Perform general record type parsing and wildcards check
dnsrecon -d example.com -t brt -D subdomains.txtDictionary brute force - Guess host names using a custom local text wordlist file
dnsrecon -d example.comStandard enumeration
dnsrecon -d example.com -t axfrZone transfer
dnsrecon -d example.com -t brt -D wordlist.txtBrute force
dnsrecon -r 192.168.1.0/24Reverse lookup
dnsrecon -d example.comStandard DNS recon
dnsrecon -d example.com -t stdStandard enumeration
dnsrecon -d example.com -t brt -D wordlist.txtBrute-force subdomains
dnsrecon -d example.com -t axfrZone transfer attempt
dnsrecon -d example.com -t srvSRV record enumeration
dnsrecon -d example.com -t tldTLD enumeration
dnsrecon -d example.com -n 8.8.8.8Custom DNS server
dnsrecon -d example.com -j output.jsonJSON output
dnsrecon -d example.com -x output.xmlXML output

Step-by-Step Guide

  1. 1Execute a standard record enumeration as your first step
  2. 2Test the nameservers to see if they allow zone transfers
  3. 3Apply a custom dictionary file to brute-force hidden records
  4. 4Conduct reverse lookups against entire IP ranges to map the network
  5. 5Save your compiled data into a structured format for documentation

Use Cases

Zone Transfer Testing

Check if DNS servers allow unauthorized zone transfers, revealing all DNS records.

DNS Record Enumeration

Discover NS, MX, TXT, SOA, SRV, and other DNS records for target domains.

Brute-force Subdomains

Discover subdomains by guessing hostnames using custom wordlists.

Reverse DNS Lookups

Resolve IP addresses to hostnames to discover additional infrastructure.

Cache Snooping

Check if DNS servers cache specific records to gather intelligence.

DNS Auditing

Perform comprehensive DNS security audits for compliance and assessment.

Key Features

Related Tools

DNSenum

Information Gathering

DNS enumeration tool for zone transfer testing and record analysis.

Fierce

Information Gathering

Fast DNS brute-forcing and IP range discovery.

Frequently Asked Questions

What is DNSRecon used for?

DNSRecon is a comprehensive DNS enumeration tool used for checking NS records, MX records, zone transfers, SRV records, performing DNS brute-forcing, reverse DNS lookups, and cache snooping. It provides a complete DNS audit of target domains.

What is zone transfer testing in DNSRecon?

Zone transfer testing checks if a DNS server will share its entire DNS database with unauthorized clients. If zone transfers are enabled, you can discover all subdomains and DNS records in a single request.

Does DNSRecon require root privileges?

No, DNSRecon performs standard DNS queries that don't require elevated privileges. It runs without root on all supported platforms.

How is DNSRecon different from DNSenum?

DNSRecon and DNSenum are similar tools. DNSRecon offers cache snooping and more output formats, while DNSenum provides deeper record analysis. Both support zone transfers and brute-forcing.

How do I install DNSRecon?

Install DNSRecon using: sudo apt install dnsrecon on Kali Linux. On other systems, install via pip: pip install dnsrecon, or clone from the GitHub repository and run python3 dnsrecon.py.

How do I use DNSRecon for zone transfer testing?

Run dnsrecon -d example.com -t axfr to test for zone transfers. If successful, DNSRecon will dump all DNS records from the target nameserver.

What are the most common DNSRecon commands?

Common commands include: dnsrecon -d target.com (standard enum), dnsrecon -d target.com -t axfr (zone transfer), dnsrecon -d target.com -t brt -D wordlist.txt (brute-force), dnsrecon -r 192.168.1.0/24 (reverse DNS).

How do I perform cache snooping with DNSRecon?

Use dnsrecon -d target.com -t snoop -n ns1.target.com -f domains.txt to check if specific domains are cached by the target nameserver. This reveals recently queried records.

How does DNSRecon compare to dig?

DNSRecon automates comprehensive DNS enumeration including zone transfers, brute-forcing, and cache snooping. dig performs individual DNS queries. Use DNSRecon for bulk enumeration; dig for specific record lookups.

How does DNSRecon compare to fierce?

DNSRecon offers zone transfer testing, cache snooping, and multiple output formats. Fierce is faster for basic DNS brute-forcing and IP range discovery. Use both for comprehensive coverage.

Is DNSRecon legal to use?

DNSRecon itself is legal software. However, scanning domains without permission may violate laws. Zone transfer attempts against unauthorized nameservers may be considered unauthorized access. Always obtain proper authorization.

What output formats does DNSRecon support?

DNSRecon supports JSON (-j), XML (--xml), and CSV (-c) output formats. Use -j output.json for JSON format, --xml output.xml for XML, or -c csv for CSV output.

How do I use DNSRecon with a custom wordlist?

Use the -D flag with a wordlist file: dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains.txt. Larger wordlists provide more comprehensive subdomain discovery.

What DNS records can DNSRecon discover?

DNSRecon discovers NS, MX, TXT, SOA, SRV, A, AAAA, and other DNS record types. It provides a comprehensive view of the target's DNS infrastructure.

Why is DNSRecon not finding zone transfers?

Most properly configured DNS servers disable zone transfers for unauthorized clients. DNSRecon tests this, but modern DNS configurations typically restrict zone transfers to authorized secondary nameservers only.

How do I use DNSRecon for reverse DNS lookups?

Use dnsrecon -r 192.168.1.0/24 to perform reverse DNS lookups across an IP range. This discovers hostnames associated with IP addresses, revealing additional infrastructure.

What is the -t flag in DNSRecon?

The -t flag specifies the enumeration type: std (standard), axfr (zone transfer), brt (brute-force), rvl (reverse lookup), snoop (cache snooping), and tld (top-level domain).

How long does a DNSRecon scan take?

A standard DNSRecon scan completes in 30-60 seconds. Zone transfer tests are instant. Brute-force scans depend on wordlist size, typically taking 1-10 minutes.

Tags

#reconnaissance#dns-enumeration#brute-force#audit

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.