Skip to content
Home

OSINT and DNS recon toolbelt

A collection of OSINT and DNS reconnaissance tools.

bash·1 min read··INE Certification

A handful of single-purpose passive-recon tools that all follow the same pattern: point them at a domain and get a report back. Grouping them here because none needs more than a line or two, but together they cover most of a passive information-gathering pass.

DNS enumeration

# dnsenum: DNS records, zone transfer attempt, subdomain brute-force
dnsenum example.com
dnsenum --noreverse example.com              # skip WHOIS lookups, faster
dnsenum --enum -f wordlist.txt example.com   # brute-force subdomains

# dnsrecon: similar DNS enumeration, packaged with Kali
dnsrecon -d example.com

# fierce: locates non-contiguous IP space via DNS
fierce --domain example.com

Subdomains and emails

# sublist3r: passive subdomain enumeration via search engines (Google/Yahoo/Bing) + OSINT sources
sublist3r -d example.com -e google,yahoo

# theHarvester: emails, subdomains, hosts from public/OSINT sources
theHarvester -d example.com -b all
theHarvester -d example.com -b dnsdumpster,duckduckgo,crtsh   # limit to specific sources

Web fingerprinting

# wafw00f: identify what WAF sits in front of a target
wafw00f example.com

# whatweb: fingerprint the web stack (server, CMS, libraries, etc)
whatweb example.com

# browsh full terminal-based browser
browsh --startup-url http://<target_ip>

wafw00f and whatweb are usually run back-to-back at the start of any web-facing engagement, right alongside whois <domain> and host <domain> for the absolute basics.