🌀 dnsgen (DNS generator)
This tool generates a combination of domain names from the provided input. Combinations are created based on wordlist. Custom words are extracted per execution. Refer to Techniques section to learn more.
pip3 install dnsgen
..or from GitHub directly:
git clone https://github.com/ProjectAnte/dnsgen cd dnsgen pip3 install -r requirements.txt python3 setup.py install
$ dnsgen domains.txt (
domains.txt contains a list of active domain names)
--wordlen: minimum size of custom words to be extracted
--wordlist: path to custom wordlist
filename: required parameter for an input list of domains. The input file should contain domain names separated by newline character (
\n). You can also use STDIN as an input method, providing
-to this argument.
Combination with massdns:
$ cat domains.txt | dnsgen - | massdns -r /path/to/resolvers.txt -t A -o J --flush 2>/dev/null
(For demo purposes, let's say that wordlist contains just one word:
Insert word on every index — Creates new subdomain levels by inserting the words between existing levels.
Insert num on every index — Creates new subdomain levels by inserting the numbers between existing levels.
Increase/Decrease num found — (In development) If number is found in an existing subdomain, increase/decrease this number without any other alteration.
Prepend word on every index — On every subdomain level, prepend existing content with
Append word on every index — On every subdomain level, append existing content with
Replace the word with word — If word longer than 3 is found in an existing subdomain, replace it with other words from the wordlist. (If we have more words than one in our wordlist).
Extract custom words — Extend the wordlist based on target's domain naming conventions. Such words are either whole subdomain levels, or
-is used for a split on some subdomain level. For instance
datastreamwords. To prevent the overflow, user-defined word length is used for word extraction. The default value is set to 6. This means that only words strictly longer than 5 characters are included (from the previous example,
mapp1does not satisfy this condition).
- Improve README