0.工具介绍

dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would typically discover the target company's IP netblocks, domain names, phone numbers, etc ...

Subdomain brute-forcing is another technique that should be used in the enumeration stage, as it's especially useful when other domain enumeration techniques such as zone transfers don't work (I rarely see zone transfers being publicly allowed these days by the way).

1.工具位置

命令行 root@bt:/pentest/enumeration/dns/dnsmap#

dir查看目录dnsmap dnsmap-bulk.sh use_cases.txt wordlist_TLAs.txt，其中wordlist_TLAs.txt为字典文件，dnsmap为可执行程序

图形界面 Applications --> BackTrack --> Information Gathering --> Network Analysis --> Dnsanalysis --> Dnsmap

2.工具参数

-w wordlist_TLAs.txt 指定字典文件

-c cisco.csv 输出文件

cisco.com 目标域名

3.使用示例

root@bt:/pentest/enumeration/dns/dnsmap# ./dnsmap cisco.com -w wordlist_TLAs.txt -c cisco.csv

我的测试：

root@bt:/pentest/enumeration/dns/dnsmap# ./dnsmap gzu.edu.cn -w wordlist_TLAs.txt -c gzu.csv

results：

好像挺少的，可是花了很久的时间。

用的是wordlist_TLAs.txt来扫描。