retour aux outils back to tools Ducklings

fierce

Scanner DNS pour localiser des espaces IP non contigus et des hostnames pour des domaines donnés. Effectue des transferts de zone, brute-force les sous-domaines et cartographie les réseaux internes. DNS scanner for locating non-contiguous IP space and hostnames against specified domains. Performs zone transfers, brute-forces subdomains, and maps internal networks.

↗ https://github.com/mschwager/fierce

Overview

fierce is a DNS reconnaissance tool designed to locate non-contiguous IP space belonging to a domain. Unlike simple subdomain brute-forcers, it also performs reverse lookups on nearby IP ranges to discover hosts not enumerable through DNS brute-force. Useful for mapping internal network segments.

Basic Usage

Basic domain scan

fierce --domain example.com

Use a custom wordlist

fierce --domain example.com --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Specify DNS server

fierce --domain example.com --dns-servers 8.8.8.8

Wider subnet range scan after finding hosts

fierce --domain example.com --wide

Delay between requests (seconds)

fierce --domain example.com --delay 1

Concatenate domain on each word in wordlist

fierce --domain example.com --subdomain-file wordlist.txt

Output Examples

NS: ns1.example.com. => 1.2.3.4
NS: ns2.example.com. => 1.2.3.5
SOA: ns1.example.com. => 1.2.3.4
Zone transfer was refused

Trying zone transfer first...
  Testing ns1.example.com
    Request timed out or transfer not allowed.

Brute forcing with /usr/share/fierce/hosts.txt:
  Found: dev.example.com. (10.0.0.5)
  Found: mail.example.com. (1.2.3.10)
  Found: vpn.example.com. (1.2.3.20)

Scanning IP Ranges

After finding hosts, scan surrounding IPs fierce automatically tries nearby /24 subnets

fierce --domain example.com --wide

Traverse the entire found subnet

fierce --domain example.com --traverse 10

Connect timeout

fierce --domain example.com --connect --timeout 3

Tips

  • Try zone transfer first — any success gives you the full zone for free
  • Use --wide to discover hosts that don’t appear in DNS at all but are in adjacent IP space
  • Combine with dnsrecon -r for comprehensive reverse lookup coverage
  • Default wordlist is at /usr/share/fierce/hosts.txt
Help / Man page 
fierce [--domain DOMAIN] [options]

--domain DOMAIN         Target domain
--dns-servers NS [NS..] DNS servers to use
--wordlist FILE         Subdomain brute-force wordlist
--wide                  Scan entire class C after finding a host
--traverse N            How many IPs around found host to reverse-resolve
--search REGEX          Only output results matching regex
--range RANGE           Scan specific IP range (CIDR)
--delay N               Delay between requests (seconds)
--connect               Try to connect to found hosts (TCP 80)
--timeout N             TCP timeout in seconds

Vue d’ensemble

fierce est un outil de reconnaissance DNS conçu pour localiser des espaces IP non contigus appartenant à un domaine. Contrairement aux simples brute-forceurs de sous-domaines, il effectue aussi des lookups inversés sur les plages IP voisines pour découvrir des hôtes non énumérables par brute-force DNS. Utile pour cartographier des segments de réseau interne.

Utilisation de base

# Scan de domaine basique
fierce --domain example.com

# Utiliser une wordlist personnalisée
fierce --domain example.com --wordlist /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Spécifier un serveur DNS
fierce --domain example.com --dns-servers 8.8.8.8

# Scan de plage de sous-réseau plus large après avoir trouvé des hôtes
fierce --domain example.com --wide

# Délai entre les requêtes (secondes)
fierce --domain example.com --delay 1

# Concaténer le domaine à chaque mot de la wordlist
fierce --domain example.com --subdomain-file wordlist.txt

Exemples de sortie

NS: ns1.example.com. => 1.2.3.4
NS: ns2.example.com. => 1.2.3.5
SOA: ns1.example.com. => 1.2.3.4
Zone transfer was refused

Trying zone transfer first...
  Testing ns1.example.com
    Request timed out or transfer not allowed.

Brute forcing with /usr/share/fierce/hosts.txt:
  Found: dev.example.com. (10.0.0.5)
  Found: mail.example.com. (1.2.3.10)
  Found: vpn.example.com. (1.2.3.20)

Scanner des plages IP

# Après avoir trouvé des hôtes, scanner les IP environnantes ; fierce essaie automatiquement les sous-réseaux /24 voisins
fierce --domain example.com --wide

# Parcourir tout le sous-réseau trouvé
fierce --domain example.com --traverse 10

# Délai de connexion
fierce --domain example.com --connect --timeout 3

Conseils

  • Essayer d’abord le transfert de zone : tout succès donne gratuitement la zone complète
  • Utiliser --wide pour découvrir des hôtes qui n’apparaissent pas du tout en DNS mais qui se trouvent dans un espace IP adjacent
  • Combiner avec dnsrecon -r pour une couverture complète des lookups inversés
  • La wordlist par défaut se trouve dans /usr/share/fierce/hosts.txt
Aide / Page de manuel 
fierce [--domain DOMAIN] [options]

--domain DOMAIN         Target domain
--dns-servers NS [NS..] DNS servers to use
--wordlist FILE         Subdomain brute-force wordlist
--wide                  Scan entire class C after finding a host
--traverse N            How many IPs around found host to reverse-resolve
--search REGEX          Only output results matching regex
--range RANGE           Scan specific IP range (CIDR)
--delay N               Delay between requests (seconds)
--connect               Try to connect to found hosts (TCP 80)
--timeout N             TCP timeout in seconds