0.工具介紹
dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would typically discover the target company's IP netblocks, domain names, phone numbers, etc ...
Subdomain brute-forcing is another technique that should be used in the enumeration stage, as it's especially useful when other domain enumeration techniques such as zone transfers don't work (I rarely see zone transfers being publicly allowed these days by the way).
1.工具位置
命令行 root@bt:/pentest/enumeration/dns/dnsmap#
dir查看目錄dnsmap dnsmap-bulk.sh use_cases.txt wordlist_TLAs.txt，其中wordlist_TLAs.txt為字典文件，dnsmap為可執行程序
圖形界面 Applications --> BackTrack --> Information Gathering --> Network Analysis --> Dnsanalysis --> Dnsmap
2.工具參數
-w wordlist_TLAs.txt 指定字典文件
-c cisco.csv 輸出文件
cisco.com 目標域名
3.使用示例
root@bt:/pentest/enumeration/dns/dnsmap# ./dnsmap cisco.com -w wordlist_TLAs.txt -c cisco.csv
我的測試：
root@bt:/pentest/enumeration/dns/dnsmap# ./dnsmap gzu.edu.cn -w wordlist_TLAs.txt -c gzu.csv
results：
acc.gzu.edu.cn,210.40.3.97 agr.gzu.edu.cn,210.40.3.3 ams.gzu.edu.cn,210.40.3.92 amt.gzu.edu.cn,210.40.3.63 art.gzu.edu.cn,210.40.3.3 bbs.gzu.edu.cn,210.40.3.28 cce.gzu.edu.cn,210.40.3.3 cdo.gzu.edu.cn,210.40.3.3 cjg.gzu.edu.cn,210.40.3.36 cjs.gzu.edu.cn,210.40.3.3 cpc.gzu.edu.cn,210.40.3.29 cst.gzu.edu.cn,210.40.3.3 cyl.gzu.edu.cn,210.40.3.228 dns.gzu.edu.cn,210.40.0.33 dpo.gzu.edu.cn,210.40.3.3 dsa.gzu.edu.cn,210.40.32.40 ecb.gzu.edu.cn,210.40.3.59 eda.gzu.edu.cn,210.40.3.225 ehr.gzu.edu.cn,210.40.3.237 eol.gzu.edu.cn,210.40.0.56 ese.gzu.edu.cn,210.40.3.111 fcc.gzu.edu.cn,210.40.3.55 fcm.gzu.edu.cn,210.40.3.64 gia.gzu.edu.cn,210.40.3.3 gsa.gzu.edu.cn,210.40.3.222 gsr.gzu.edu.cn,210.40.0.58 hss.gzu.edu.cn,210.40.3.3 hum.gzu.edu.cn,210.40.3.3 inf.gzu.edu.cn,210.40.0.59 ipe.gzu.edu.cn,210.40.3.248 isr.gzu.edu.cn,210.40.3.249 kst.gzu.edu.cn,210.40.3.3 law.gzu.edu.cn,210.40.3.243 lib.gzu.edu.cn,210.40.3.3 mdc.gzu.edu.cn,210.40.3.3 mnh.gzu.edu.cn,210.40.3.89 nab.gzu.edu.cn,210.40.3.247 nic.gzu.edu.cn,210.40.0.38 noc.gzu.edu.cn,210.40.0.38 oas.gzu.edu.cn,210.40.2.55 oir.gzu.edu.cn,210.40.3.75 org.gzu.edu.cn,210.40.3.41 phc.gzu.edu.cn,210.40.3.246 psl.gzu.edu.cn,210.40.3.3 rso.gzu.edu.cn,210.40.3.57 sci.gzu.edu.cn,210.40.3.3 sec.gzu.edu.cn,210.40.3.31 snt.gzu.edu.cn,210.40.3.27 stc.gzu.edu.cn,210.40.3.100 sva.gzu.edu.cn,210.40.3.90 vod.gzu.edu.cn,210.40.0.121 web.gzu.edu.cn,210.40.3.19 www.gzu.edu.cn,210.40.0.58
好像挺少的，可是花了很久的時間。
用的是wordlist_TLAs.txt來掃描。