fierce

Locates non-contiguous internal ranges of a domain from DNS.

DNS reconnaissance with a very specific goal: finding the address space an organisation actually uses. It tries the zone transfer, brute forces common names and, when it hits an IP, explores its neighbours to discover internal blocks that are neither contiguous nor listed in any public record. It is slow and noisy, but it shows the shape of the network before you touch it.

Family Recon, DNS & OSINT

Flags --domain --dns-servers --subdomain-file

Concepts DNS zone transfer (AXFR)

Cheatsheet DNS · 53

Installation

sudo apt install -y fierce

Useful commands3 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.