Fierce

Fierce is a DNS reconnaissance tool used for discovering subdomains, mapping IP ranges, performing reverse DNS lookups, and detecting wildcard DNS configurations. It helps security professionals understand the network layout of target domains.

While newer tools like Amass and Subfinder offer more features, Fierce remains useful for quick DNS brute-forcing and IP range discovery. Its simplicity and speed make it a good starting point for DNS reconnaissance.

Fierce focuses on DNS brute-forcing and IP range mapping, while DNSenum provides more comprehensive DNS enumeration including zone transfer testing. Fierce is faster for brute-forcing; DNSenum offers deeper DNS analysis.

No, Fierce runs without root privileges. It performs standard DNS queries that don't require elevated permissions, making it safe for all environments.

Install Fierce using: sudo apt install fierce on Kali Linux. On other systems, install via pip: pip install fierce, or clone from the GitHub repository and install manually.

Run fierce --domain target.com for standard DNS enumeration. Fierce will discover subdomains through brute-forcing, perform reverse DNS lookups, and map adjacent IP ranges.

Common commands include: fierce --domain target.com (standard scan), fierce --domain target.com --subdomains wordlist.txt (custom wordlist), fierce --domain target.com --dns-servers 8.8.8.8 (custom DNS server).

Fierce tests for wildcard DNS by resolving random subdomains. If they all resolve to the same IP, wildcard DNS is active. This prevents false positives during brute-forcing.

Subfinder uses passive sources (20+) for subdomain discovery without touching the target. Fierce performs active DNS brute-forcing. Use Subfinder for stealth; Fierce for active brute-forcing.

Amass is a comprehensive attack surface mapping tool with 20+ data sources and active/passive modes. Fierce is simpler and faster for quick DNS brute-forcing. Use Fierce for initial recon; Amass for thorough coverage.

Fierce itself is legal software. However, scanning domains without permission from the owner may violate laws. Always obtain written authorization before performing DNS reconnaissance on targets you don't own.

The --subdomains flag specifies a custom wordlist file for DNS brute-forcing. Use a larger wordlist from SecLists for more comprehensive subdomain discovery than the built-in list.

Fierce performs reverse DNS lookups on discovered IP addresses to find adjacent IPs. This reveals the full network range belonging to the target organization, including non-contiguous IP space.

Fierce uses a small built-in wordlist. For better results, use a custom wordlist with --subdomains flag. Also check if wildcard DNS is active, which can obscure real subdomains.

The --delay flag adds a delay between DNS requests to avoid rate limiting or detection. Use --delay 1 for a 1-second delay between queries.

Fierce scans one domain at a time. For multiple domains, run Fierce separately for each or create a bash script to iterate through a list of targets.

Use the --file flag to save results: fierce --domain target.com --file output.txt. This saves all discovered subdomains, IP ranges, and other findings to a text file.

A standard Fierce scan completes in 1-5 minutes depending on the target domain, network conditions, and wordlist size. Larger custom wordlists increase scan time.

The --traverse flag limits IP range traversal to a specified number of adjacent IPs. Use --traverse 5 to limit discovery to 5 IPs in each direction from discovered hosts.