1. Introduction and description

dnsenum is a multithread script to enumerate information on a domain and to discover non-contiguous IP blocks.

In addition, the tool offers added value with:

• Google Searches
• Brute-forcing hosts
• Whois netrange lookups
• Reverse lookups

Please give a short description of the following points:

1. describe the benefit of the Google option
2. describe the benefit of the brute-force option
3. describe the benefit of whois netrange option
4. describe your lesson learned

2. Answer

1. Also known as Google scraping (allinurl: -www site:target.com) this can be helpful to find additional domains to a reverse dns lookup or when zone transfer is disabled. (It should be in most cases)
2. Benefit lays in finding additional subdomains when your results on standard dns queries doesn’t satisfy you. Bruteforcenames from dnscan tool are based on research, by analysing thousands of domains.
   

   The first four (subdomains-100.txt, subdomains-500.txt, subdomains-1000.txt and subdomains-10000.txt) were created by analysing the most commonly occuring subomdains in approximately 86,000 zone files that were transferred as part of a separate research project. These wordlists are sorted by the popularity of the subdomains (more strictly by the percentage of zones that contained them in the dataset).

3. It calculates C Class domain ranges and perform whois queries on it, but I can’t see a real benefit of it yet.
   
4. The more time you spend in information gathering, the more results you get. The best thing is to combine different tools and techniques, but as we’ve allready learned in previous exercises it can be a very time consuming task.

PDF Report:
dns_enum#1