← retour aux outils back to tools

# fierce

Scanner DNS pour localiser des espaces IP non contigus et des hostnames pour des domaines donnés. Effectue des transferts de zone, brute-force les sous-domaines et cartographie les réseaux internes. DNS scanner for locating non-contiguous IP space and hostnames against specified domains. Performs zone transfers, brute-forces subdomains, and maps internal networks.

↗ https://github.com/mschwager/fierce

## Overview

fierce is a DNS reconnaissance tool designed to locate non-contiguous IP space belonging to a domain. Unlike simple subdomain brute-forcers, it also performs reverse lookups on nearby IP ranges to discover hosts not enumerable through DNS brute-force. Useful for mapping internal network segments.

## Basic Usage

Basic domain scan

    fierce --domain example.com

Use a custom wordlist

    fierce --domain example.com --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Specify DNS server

    fierce --domain example.com --dns-servers 8.8.8.8

Wider subnet range scan after finding hosts

    fierce --domain example.com --wide

Delay between requests (seconds)

    fierce --domain example.com --delay 1

Concatenate domain on each word in wordlist

    fierce --domain example.com --subdomain-file wordlist.txt

## Output Examples

    NS: ns1.example.com. => 1.2.3.4
    NS: ns2.example.com. => 1.2.3.5
    SOA: ns1.example.com. => 1.2.3.4
    Zone transfer was refused

    Trying zone transfer first...
      Testing ns1.example.com
        Request timed out or transfer not allowed.

    Brute forcing with /usr/share/fierce/hosts.txt:
      Found: dev.example.com. (10.0.0.5)
      Found: mail.example.com. (1.2.3.10)
      Found: vpn.example.com. (1.2.3.20)

## Scanning IP Ranges

After finding hosts, scan surrounding IPs fierce automatically tries nearby /24 subnets

    fierce --domain example.com --wide

Traverse the entire found subnet

    fierce --domain example.com --traverse 10

Connect timeout

    fierce --domain example.com --connect --timeout 3

## Tips

- Try zone transfer first — any success gives you the full zone for free
- Use `--wide` to discover hosts that don’t appear in DNS at all but are in adjacent IP space
- Combine with `dnsrecon -r` for comprehensive reverse lookup coverage
- Default wordlist is at `/usr/share/fierce/hosts.txt`

Help / Man page

    fierce [--domain DOMAIN] [options]

    --domain DOMAIN         Target domain
    --dns-servers NS [NS..] DNS servers to use
    --wordlist FILE         Subdomain brute-force wordlist
    --wide                  Scan entire class C after finding a host
    --traverse N            How many IPs around found host to reverse-resolve
    --search REGEX          Only output results matching regex
    --range RANGE           Scan specific IP range (CIDR)
    --delay N               Delay between requests (seconds)
    --connect               Try to connect to found hosts (TCP 80)
    --timeout N             TCP timeout in seconds

## Vue d’ensemble

fierce est un outil de reconnaissance DNS conçu pour localiser des espaces IP non contigus appartenant à un domaine. Contrairement aux simples brute-forceurs de sous-domaines, il effectue aussi des lookups inversés sur les plages IP voisines pour découvrir des hôtes non énumérables par brute-force DNS. Utile pour cartographier des segments de réseau interne.

## Utilisation de base

    # Scan de domaine basique
    fierce --domain example.com

    # Utiliser une wordlist personnalisée
    fierce --domain example.com --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

    # Spécifier un serveur DNS
    fierce --domain example.com --dns-servers 8.8.8.8

    # Scan de plage de sous-réseau plus large après avoir trouvé des hôtes
    fierce --domain example.com --wide

    # Délai entre les requêtes (secondes)
    fierce --domain example.com --delay 1

    # Concaténer le domaine à chaque mot de la wordlist
    fierce --domain example.com --subdomain-file wordlist.txt

## Exemples de sortie

    NS: ns1.example.com. => 1.2.3.4
    NS: ns2.example.com. => 1.2.3.5
    SOA: ns1.example.com. => 1.2.3.4
    Zone transfer was refused

    Trying zone transfer first...
      Testing ns1.example.com
        Request timed out or transfer not allowed.

    Brute forcing with /usr/share/fierce/hosts.txt:
      Found: dev.example.com. (10.0.0.5)
      Found: mail.example.com. (1.2.3.10)
      Found: vpn.example.com. (1.2.3.20)

## Scanner des plages IP

    # Après avoir trouvé des hôtes, scanner les IP environnantes ; fierce essaie automatiquement les sous-réseaux /24 voisins
    fierce --domain example.com --wide

    # Parcourir tout le sous-réseau trouvé
    fierce --domain example.com --traverse 10

    # Délai de connexion
    fierce --domain example.com --connect --timeout 3

## Conseils

- Essayer d’abord le transfert de zone : tout succès donne gratuitement la zone complète
- Utiliser `--wide` pour découvrir des hôtes qui n’apparaissent pas du tout en DNS mais qui se trouvent dans un espace IP adjacent
- Combiner avec `dnsrecon -r` pour une couverture complète des lookups inversés
- La wordlist par défaut se trouve dans `/usr/share/fierce/hosts.txt`

Aide / Page de manuel

    fierce [--domain DOMAIN] [options]

    --domain DOMAIN         Target domain
    --dns-servers NS [NS..] DNS servers to use
    --wordlist FILE         Subdomain brute-force wordlist
    --wide                  Scan entire class C after finding a host
    --traverse N            How many IPs around found host to reverse-resolve
    --search REGEX          Only output results matching regex
    --range RANGE           Scan specific IP range (CIDR)
    --delay N               Delay between requests (seconds)
    --connect               Try to connect to found hosts (TCP 80)
    --timeout N             TCP timeout in seconds