NAME
  dnsmap - scan for subdomains using bruteforcing techniques

SYNOPSIS
  dnsmap <target-domain> [options]

DESCRIPTION
  dnsmap scans a domain for common subdomains using a built-in or an external wordlist (if specified
  with -w option). The internal wordlist has around 1000 words in English and Spanish as ns1, firewall,
  servicios and smtp. So will be possible search for smtp.example.com inside example.com automatically.
  Results can be saved in CSV and human-readable format for further processing. dnsmap does NOT require
  root privileges to be run, and should NOT be run with such privileges for security reasons.

  dnsmap was originally released back in 2006 and was inspired by the fictional story "The Thief No One
  Saw" by Paul Craig, which can be found in the book "Stealing the Network - How to 0wn the Box".

  dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of
  infrastructure security assessments. During the enumeration stage, the security consultant would
  typically discover the target company's IP netblocks, domain names, phone numbers, etc.

  Subdomain bruteforcing is another technique that should be used in the enumeration stage, as it's
  especially useful when other domain enumeration techniques such as zone transfers don't work (is
  rare to see zone transfers being publicly allowed these days by the way).

  Fun things that can happen:

   1. Finding interesting remote access servers (e.g.: https://extranet.example.com).

   2. Finding badly configured and/or unpatched servers (e.g.: test.example.com).

   3. Finding new domain names which will allow you to map non-obvious/hard-to-find netblocks of your
      target organization (registry lookups - aka whois is your friend).

   4. Sometimes you find that some bruteforced subdomains resolve to internal IP addresses (RFC 1918).
      This is great as sometimes they are real up-to-date "A" records which means that it *is* possible
      to enumerate internal servers of a target organization from the Internet by only using standard
      DNS resolving (as opposed to zone transfers for instance).

   5. Discover embedded devices configured using Dynamic DNS services (e.g.: IP Cameras). This method
      is an alternative to finding devices via Google hacking techniques.

OPTIONS
  -w <wordlist-file>         Use an external wordlist instead of the built-in one. You can use programs
                             as crunch or cupp to generate personalized wordlists.
  -r <regular-results-file>  Save results to a plain text file. If a file name isn't supplied, dnsmap will
                             create an unique filename which includes the current timestamp. e.g.:
                             dnsmap_example_com_br_2019_11_15_214812.txt. So, you can provide a directory
                             name only, as -r /tmp.
  -c <csv-results-file>      Save results in CSV format in a file. If a file name isn't provided, dnsmap
                             will create something as dnsmap_example_com_br_2019_11_15_220114.csv. This
                             is a similar behaviour from -r option.
  -d <delay-millisecs>       Limit of random delay in milliseconds between successive queries. Delay
                             value is a maximum random value. e.g. if you enter 1000, each DNS request
                             will be delayed a *maximum* of 1 second. By default, dnsmap uses a value
                             of 10 milliseconds of maximum delay between DNS lookups. It is recommended
                             to use the -d (delay in milliseconds) option in cases where dnsmap is
                             interfering with your online experience. i.e.: killing your bandwidth. If
                             used, delay must be between 1 and 300000 milliseconds (5 minutes).
  -i <ips-to-ignore>         IP addresses to ignore in the results (useful if you get obtaining false
                             positives). Use commas without spaces to separate the IP addresses. The
                             maximum number of IPs to filter is 5. Example: 203.0.113.10,198.51.199.65

INTERNAL WORDLIST
  The built-in wordlist is defined in src/dnsmap.h file. If needed, see the file to know all words.

EXAMPLES
  Subdomain bruteforcing using dnsmap's built-in wordlist:

    $ dnsmap example.com

  Subdomain bruteforcing using a user-supplied wordlist:

    $ dnsmap example.com -w wordlist.txt

  Subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/ :

    $ dnsmap example.com -r /tmp

  Example of subdomain bruteforcing using the built-in wordlist, saving the results to /tmp/, and waiting
  a random maximum of 300 milliseconds between each request:

    $ dnsmap example.com -r /tmp/ -d 300

  Subdomain bruteforcing with 0.8 seconds delay, saving results in regular and CSV format, filtering 2
  user-provided IP and using a user-supplied wordlist:

    $ dnsmap example.com -d 800 -r /tmp/ -c /tmp/ -i 10.55.206.154,10.55.24.100 -w ./wordlist_TLAs.txt

BUGS
  Currently, dnsmap does not yet support parallel scanning and hence take quite a long time.

  New bugs should be reported at https://github.com/resurrecting-open-source-projects/dnsmap/issues

SEE ALSO
  crunch(1), cupp(1), dnsmap-bulk(1)

AUTHOR
  dnsmap was originally written by "pagvac" in 2006. Currently it is maintained by volunteers,
  inside dnsmap project, at https://github.com/resurrecting-open-source-projects/dnsmap/

  This manpage was written by Joao Eriberto Mota Filho.
