Subdomains Tools Review: a full and detailed comparison of subdomain enumeration tools
The enumeration of subdomains is part of an almost mandatory process when attacking a new target. However, there are dozens of tools to perform this task, using as many different sources and techniques. Bruteforce, DNS alteration, permutation, passive or active collection… To help you choose the best equipment for your daily hunt, we have compiled a detailed comparison of these tools.
This article is a guest blog post written by Six2dez.
Methodology
It has been almost a year since I did my first comparison of subdomain enumeration tools and since then new tools have appeared, well, to be honest, many new tools have appeared, some existing ones have improved and others have been displaced by new languages and technologies.
The following sections will describe the methodology followed to carry out the comparison and the aspects that have been kept in mind to assess the results.
Following the previous review, I have classified the tools according to the typology or technique used to collect data, for each type of technique measurements have been made in three different domains of one of the public programs on YesWeHack, specifically the program that has been chosen as a target is Lazada.
Techniques
- Passive: these types of tools collect data from third-party services, both free and paid, which are based on API tokens and credits that you spend each time you request a data set from them in the case of paid model services. Others like GitHub, Wayback Machine, or Crt.sh might enforce some types of bans if you abuse them in a short amount of time, but most tools can handle this to avoid bans. In this topic, the more third-party sources you can request data from, the better. This data will be useful in the next steps of the reconnaissance process, even if the data for the subdomains is older or no longer available. To measure which tools are better than others, I have collected the sources used by the tools, the speed to return the data, and the amount of data returned.
- DNS resolution: this topic will cover both DNS resolution and DNS brute force because in the end it is the same, just change the way the input is provided (list of subdomains vs target + list of words). The key points here are more complicated because we have to consider a combination of speed and precision, we don’t want as many results as we can because we need to determine which results are valid from a given input. To measure which tools are better than others in this field, I resolved a list of subdomains in the 3 target domains and checked the accuracy of the output and the speed to process the resolution with a list of subdomains with around 100K lines and another with more than 9 million subdomains.
- Permutations: this is a special test because in this technique we only need to create a good quality dictionary to solve with any tool used for DNS resolution. The technique of alterations and permutations consists of creating a dictionary given a list of subdomains and a list of permutations, a good tool should iterate over the numbers up and down, and build as many combinations as possible. The key points here are the quantity of the dictionary and the quality of the results given. To measure which tools do this job successfully, I took the speed, the quantity, and manually checked the results to measure the quality.
Key values
- Sources: number of sources integrated into the tool. 5 stars for the tool with the most tools implemented.
- Speed: this is always an important point in any tool used, the faster it is, the faster you will be. The tool that takes the shortest time will score 5 stars.
- Quantity: we usually want as many results as we can, so the tool that returns the most data will have 5 stars, except for the DNS resolution where I have measured this value and checked which tool has the most accurate results.
- Quality: Only measured based on DNS resolution and permutations. I want to be clear, this is a completely subjective value based on my experience and how useful I find the results that the tools give me.
I have researched many (actually, MANY) tools on this topic and the first tool list for this review consisted of a list of over 50 tools, but during the analysis, I realized that most of the tools are making requests almost to the same sources, they process it and return the same data in the case of passive sources. So I decided to remove some tools from the comparison as they were not adding as much value as I would like from my point of view. Also, all the tools have been released with the best set of indicators I found to get the best results.
Technical data
All tools have been running on a new Ubuntu VPS with the following specs:
- 2 CPU Cores.
- 4 GB RAM.
- No network limit.
- 80 GB disk space.
- Different locations (eu-central, us-central and ap-west).
As most of the bug hunters are running tasks on VPS, I chose a mid-tier host to avoid crashes due to low resource machines, anyway some tools crashed due to resource limitations, but I think these kinds of tools shouldn’t require a lot of CPU or RAM, in fact, it should be able to run on an RPi (not recommended though).
Targets
From Lazada public bug bounty program:
- lazada.com
- redmart.com
- lazada.sg
Lists used
- Default subdomains list custom.
- Big subdomains list (from Assetnote).
- Permutations list custom.
- Resolvers list generated with dnsvalidator.
Results
All results have been compiled in a sheet to give you a global and synthetic review of each tool (time for execution, number of subdomains discovered, command used, wordlist used…).
Tools
Type | Tool | Repo | Stars | Latest release | Latest commit | Programming Language |
Passive | Amass | https://github.com/OWASP/Amass | 6,1K | 3.15.0 | 12 nov 2021 | Go |
Passive | Sublist3r | https://github.com/aboul3la/Sublist3r | 6,5K | 1.1 | 29 jul 2020 | Python |
Passive | crobat | https://github.com/Cgboal/SonarSearch | 428 | – | 17 sept 2021 | Go |
Passive | chaos | https://github.com/projectdiscovery/chaos-client | 270 | 0.1.9 | 20 oct 2021 | Go |
Passive | subfinder | https://github.com/projectdiscovery/subfinder | 4,4K | 2.4.9 | 20 oct 2021 | Go |
Passive | assetfinder | https://github.com/tomnomnom/assetfinder | 1,5K | – | 15 Apr 2020 | Go |
Passive | waybackurls | https://github.com/tomnomnom/waybackurls | 1,5K | – | 24 Apr 2020 | Go |
Passive | gau | https://github.com/lc/gau | 1,6K | 2.0.6 | 15 nov 2021 | Go |
Passive | github-subdomains | https://github.com/gwen001/github-subdomains | 276 | – | 15 Apr 2021 | Go |
Passive | findomain | https://github.com/Findomain/Findomain | 2,1K | 5.0.0 | 9 nov 2021 | Rust |
Passive | OneForAll | https://github.com/shmilylty/OneForAll | 4,1K | 0.4.3 | 19 nov 2021 | Python |
Resolution/BF | shuffledns | https://github.com/projectdiscovery/shuffledns | 692 | 1.0.4 | 20 oct 2021 | Go |
Resolution/BF | puredns | https://github.com/d3mondev/puredns | 580 | 2.0.1 | 25 jun 2021 | Go |
Resolution/BF | dnsx | https://github.com/projectdiscovery/dnsx | 629 | 1.0.7 | 19 nov 2021 | Go |
Resolution/BF | dnscan | https://github.com/rbsec/dnscan | 643 | – | 28 oct 2021 | Python |
Resolution/BF | gobuster | https://github.com/OJ/gobuster | 5,3K | 3.1.0 | 21 jun 2021 | Go |
Resolution/BF | aiodnsbrute | https://github.com/blark/aiodnsbrute | 403 | 0.3.2 | 4 jun 2019 | Python |
Resolution/BF | massdns | https://github.com/blechschmidt/massdns | 2,1K | 1.0.0 | 11 nov 2021 | C |
Resolution/BF | Amass | https://github.com/OWASP/Amass | 6,1K | 3.15.0 | 12 nov 2021 | Go |
Resolution/BF | rusolver | https://github.com/Edu4rdSHL/rusolver | 136 | 0.7.0 | 20 oct 2021 | Rust |
Wordlists | altdns | https://github.com/infosec-au/altdns | 1,6K | – | 10 sep 2021 | Python |
Wordlists | dnscewl | https://github.com/codingo/DNSCewl | 213 | – | 7 Jun 2021 | C++ |
Wordlists | gotator | https://github.com/Josue87/gotator | 126 | 1.1 | 24 jul 2021 | Go |
Wordlists | dmut | https://github.com/bp0lr/dmut | 99 | – | 5 jun 2021 | Go |
Wordlists | dnsgen | https://github.com/ProjectAnte/dnsgen | 511 | 1.0.4 | 24 mar 2020 | Python |
Passive results
Tools with apis | Apis added | lazada.com Time | lazada.com Results | redmart.com Time | redmart.com Results | lazada.sg Time | lazada.sg Results | Notes | Command |
Amass | 18 | 0:02:12 | 5251 | 0:02:15 | 5239 | 0:03:00 | 6610 | amass enum -passive -d domain.com | |
Sublist3r | – | 0:00:11 | 143 | 0:00:11 | 69 | 0:00:12 | 102 | python3 sublist3r.py -d domain.com | tail -n +25 | |
crobat | – | 0:00:01 | 37 | 0:00:01 | 10 | 0:00:01 | 22 | crobat -s domain.com | |
chaos | 1 | 0:00:01 | 81 | 0:00:01 | 55 | 0:00:01 | 70 | chaos -d domain.com -silent | |
subfinder | 15 | 0:00:41 | 5265 | 0:00:28 | 5110 | 0:00:30 | 5194 | subfinder -d domain.com -all -silent | |
assetfinder | 3 | 0:00:48 | 241 | 0:00:05 | 160 | 0:00:01 | 229 | Inconsistente en tiempo | assetfinder –subs-only domain.com |
waybackurls | – | 0:00:01 | 127 | 0:00:01 | 60 | 0:00:23 | 26 | waybackurls domain.com | unfurl -u domains | |
gau | – | 0:01:29 | 134 | 0:01:32 | 69 | 0:05:01 | 43 | Inconsistente en tiempo y resultados (71m!) | gau –subs domain.com | unfurl -u domains |
github-subdomains | 1 | 0:00:10 | 144 | 0:00:15 | 72 | 0:00:10 | 97 | github-subdomains -d domain.com -k -q -t .github_tokens -o result.txt | |
findomain | 4 | 0:00:06 | 246 | 0:00:02 | 181 | 0:00:08 | 201 | findomain –quiet -t domain.com | |
OneForAll | 10 | 0:03:18 | 425 | 0:02:20 | 613 | 0:01:42 | 155 | python3 oneforall.py –target domain.com –alive False –brute False –dns False –fmt json –path results/ run && cat results/domain.com.json | jq ‘.[] | .subdomain’ | |
No APIS | Custom Apis | lazada.com Time | lazada.com Results | redmart.com Time | redmart.com Results | lazada.sg Time | lazada.sg Results | Notes | Command |
Amass | – | 0:02:02 | 4233 | 0:02:58 | 253 | 0:03:14 | 3938 | amass enum -passive -d domain.com | |
Sublist3r | – | python3 sublist3r.py -d domain.com | tail -n +25 | |||||||
crobat | – | crobat -s domain.com | |||||||
chaos | – | chaos -d domain.com -silent | |||||||
subfinder | – | 0:00:24 | 249 | 0:00:06 | 115 | 0:00:26 | 160 | subfinder -d domain.com -all -silent | |
assetfinder | – | Inconsistente en tiempo | assetfinder –subs-only domain.com | ||||||
waybackurls | – | waybackurls domain.com | unfurl -u domains | |||||||
gau | – | Inconsistente en tiempo y resultados (71m!) | gau –subs domain.com | unfurl -u domains | ||||||
github-subdomains | – | github-subdomains -d domain.com -k -q -t .github_tokens -o result.txt | |||||||
findomain | – | findomain –quiet -t domain.com | |||||||
OneForAll | – | python3 oneforall.py –target domain.com –alive False –brute False –dns False –fmt json –path results/ run && cat results/domain.com.json | jq ‘.[] | .subdomain’ |
DNS results
BF short | |||||||||
Tool | lazada.com Time | lazada.com Results | redmart.com Time | redmart.com Results | lazada.sg Time | lazada.sg Results | % failure | Notes | Command |
shuffledns | 0:00:29 | 120 | 0:00:36 | 102 | 0:00:39 | 119 | 57,89 | shuffledns -d domain.com -w ~/Tools/subdomains_big.txt -r ~/Tools/resolvers.txt | |
puredns | 0:00:09 | 75 | 0:00:09 | 16 | 0:00:15 | 60 | -1,32 | puredns bruteforce ~/Tools/subdomains_big.txt domain.com -w puredns_domain.com_bf.txt -r ~/Tools/resolvers.txt | |
dnsx | — | — | — | — | — | — | |||
dnscan | 0:21:56 | 82 | 0:14:37 | 43 | 0:19:36 | 74 | 7,89 | python3 Tools/dnscan/dnscan.py -d domain.com -w ~/Tools/subdomains_big.txt -L ~/Tools/resolvers.txt | |
gobuster | 0:08:55 | 69 | 0:05:51 | 15 | 0:08:52 | 59 | -9,21 | gobuster dns -d domain.com -w ~/Tools/subdomains_big.txt -q -t 100 | |
aiodnsbrute | 0:13:28 | 151 | 0:14:53 | 85 | 0:18:48 | 202 | 98,68 | aiodnsbrute -w ~/Tools/subdomains_big.txt -r ~/Tools/resolvers.txt | |
massdns | — | — | — | — | — | — | |||
amass | 0:29:35 | 75 | 0:16:41 | 20 | 0:28:17 | 1040 | -1,32 | amass enum -brute -d domain.com -rf ~/Tools/resolvers.txt -w ~/Tools/subdomains_big.txt | |
rusolver | 0:12:55 | 59 | 0:12:19 | 15 | 0:11:04 | 49 | -22,37 | cat ~/Tools/subdomains_big.txt | rusolver -d domain.com -r ~/Tools/resolvers.txt | |
Baseline results | 76 | 16 | 65 | ||||||
BF long | |||||||||
Tool | lazada.com Time | lazada.com Results | redmart.com Time | redmart.com Results | lazada.sg Time | lazada.sg Results | % failure | Notes | Command |
shuffledns | 3:39:00 | 19834 | 1:00:31 | 3911 | 1:28:33 | 11379 | 12948,68 | shuffledns -d domain.com -w ~/Tools/subdomains.txt -r ~/Tools/resolvers.txt | |
puredns | 0:09:19 | 152 | 0:08:15 | 39 | 0:09:46 | 108 | 0,00 | puredns bruteforce ~/Tools/subdomains.txt domain.com -w puredns_domain.com_bf.txt -r ~/Tools/resolvers.txt | |
dnsx | — | — | — | — | — | — | |||
dnscan | 2:19:07 | 145 | 2:25:05 | 298 | 2:11:02 | 112 | -4,61 | python3 Tools/dnscan/dnscan.py -d domain.com -w ~/Tools/subdomains.txt -L ~/Tools/resolvers.txt | |
gobuster | 21:00:00 | 20000 | 13057,89 | More threads, less results | gobuster dns -d domain.com -w ~/Tools/subdomains.txt -q -t 100 | ||||
aiodnsbrute | 2:59:25 | 3450 | 2169,74 | aiodnsbrute -w ~/Tools/subdomains.txt -r ~/Tools/resolvers.txt | |||||
massdns | — | — | — | — | — | — | |||
amass | Crash | Crash | Crash | amass enum -brute -d domain.com -rf ~/Tools/resolvers.txt -w ~/Tools/subdomains.txt | |||||
rusolver | 9:54:02 | 98 | 11:27:35 | 21 | 10:09:22 | 76 | -35,53 | More threads more time ¿? | cat ~/Tools/subdomains.txt | rusolver -d domain.com -r ~/Tools/resolvers.txt |
Baseline results | 152 | 38 | 109 |
AltPerm results
20 subs lazada.com | ||||||
Tools | Time | Size | Unique lines | Notes | Resolved | Command |
altdns | 0:00:01 | 2,5M | 104408 | 485 | altdns -i subdomains.txt -w permutations.txt | |
dnscewl | 0:00:01 | 1,3M | 52261 | 135 | DNScewl –tL subdomains.txt -p permutations.txt –level=0 –subs –no-color | tail -n +14 | |
gotator | 0:00:02 | 3,6M | 143583 | 642 | gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 10 -mindup -adv -md -silent | |
dmut | 0:00:01 | 2,5M | 104728 | 415 | cat subdomains.txt | dmut -d permutations.txt –save-gen | |
dnsgen | 0:00:01 | 2,7M | 108302 | 631 | dnsgen subdomains.txt –wordlist permutations_list.txt | |
150 subs lazada.com | ||||||
Tools | Time | Size | Unique lines | Notes | Resolved | Command |
altdns | 0:00:02 | 21M | 847774 | 1410 | altdns -i subdomains.txt -w permutations.txt | |
dnscewl | 0:00:02 | 9,5M | 397162 | 296 | DNScewl –tL subdomains.txt -p permutations.txt –level=0 –subs –no-color | tail -n +14 | |
gotator | 0:00:18 | 32M | 1217298 | 1747 | gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 10 -mindup -adv -md -silent | |
dmut | 0:00:01 | 21M | 850463 | 805 | cat subdomains.txt | dmut -d permutations.txt –save-gen | |
dnsgen | 0:00:11 | 25M | 922930 | 1729 | dnsgen subdomains.txt –wordlist permutations_list.txt | |
500 subs lazada.com | ||||||
Tools | Time | Size | Unique lines | Notes | Resolved | Command |
altdns | 0:00:09 | 116M | 3268905 | altdns -i subdomains.txt -w permutations.txt | ||
dnscewl | 0:00:03 | 37M | 1166233 | DNScewl –tL subdomains.txt -p permutations.txt –level=0 –subs –no-color | tail -n +14 | ||
gotator | 0:03:38 | 645M | 14755896 | gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 10 -mindup -adv -md -silent | ||
dmut | 0:00:03 | 122M | 3280384 | cat subdomains.txt | dmut -d permutations.txt –save-gen | ||
dnsgen | 0:01:08 | 240M | 5625287 | dnsgen subdomains.txt –wordlist permutations_list.txt |
💡 The full tables are available here
Tools
Passive tools
Amass
- Url: https://github.com/OWASP/Amass
- Stars: 6,1K
- Language: Go
- Latest commit: 12 Nov 2021
- Sources supported: 87
Supported by OWASP and constantly updated, Amass is the most popular tool when it comes to subdomains and reconnaissance things. It supports many features, options, and settings, but for this review, I will focus on passive and active techniques.
Pros
- It has more sources supported than any other tool, it has more than 80 sources integrated, both paid and free.
- Provides more subdomains than any other tool from passive sources, even when we compare them without API keys.
- It has many functions to use as a recognition suite.
Cons
- Slower than most tools in almost all its functions.
- Crashes when bruteforcing with large word lists..
- Lack of functions in DNS bruteforce, has no control over wildcards or trusted resolvers.
Results
Sources | Speed | Quantity | DNS Speed | DNS Quality |
---|---|---|---|---|
★★★★★ | ★★☆☆☆ | ★★★★★ | ★★★★★ | ★★★☆☆ |
Sublist3r
- Url: https://github.com/aboul3la/Sublist3r
- Stars: 6,5K
- Language: Python
- Latest commit: 29 Jul 2020
- Sources supported: 11
Sublist3r was one of the first most used tools to search subdomains successfully, it also integrated subbrute to add a DNS brute force module, but lately it has been replaced by others like amass or subfinder due to lack of updates, sources and maintenance.
Pros
- It’s faster than most.
- It has interesting features like port scan or subbrute module.
Cons
- Returns fewer results than expected.
- The bruteforce module has very limited features.
- Outdated.
Results
Sources | Speed | Quantity |
---|---|---|
★★☆☆☆ | ★★★★☆ | ★★☆☆☆ |
Crobat
- Url: https://github.com/Cgboal/SonarSearch
- Stars: 428
- Language: Go
- Latest commit: 17 Sept 2021
- Sources supported: 1
Client for the SonarSearch database that retrieves data from Rapid7’s Project Sonar data set, one of the largest publicly available data sets.
Pros
- It’s very fast.
- Consistent amount of results on each execution.
Cons
- Sometimes SonarSearch API is down, making it useless.
Results
Sources | Speed | Quantity |
---|---|---|
★☆☆☆☆ | ★★★★★ | ★★☆☆☆ |
Chaos
- Url: https://github.com/projectdiscovery/chaos-client
- Stars: 270
- Language: Go
- Latest commit: 20 Oct 2021
- Sources supported: 1
Like Crobat, it is a tool for a specific source, in this case it is the official client of Project Discovery’s Chaos database that retrieves data from its own dataset.
Pros
- It’s really fast.
- Returns a fairly large amount of data without the need for third-party sources.
Cons
- Chaos API key is only provided to invited users.
Results
Sources | Speed | Quantity |
---|---|---|
★☆☆☆☆ | ★★★★★ | ★★☆☆☆ |
Subfinder
- Url: https://github.com/projectdiscovery/subfinder
- Stars: 4,4K
- Language: Go
- Latest commit: 20 Oct 2021
- Sources supported: 32
In recent years, this has been the most famous tool for obtaining subdomains of data sources, developed by Project Discovery.
Pros
- Quite fast for the number of sources it scrapes.
- One of the best in terms of sources and amount recovered.
Cons
- It could support more sources to be the most complete tool.
Results
Sources | Speed | Quantity |
---|---|---|
★★★★☆ | ★★★★☆ | ★★☆☆☆ |
Assetfinder
- Url: https://github.com/tomnomnom/assetfinder
- Stars: 1,5K
- Language: Go
- Latest commit: 15 Apr 2020
- Sources supported: 9
Subdomain extraction tool developed by the well-known tomnomnom.
Pros
- It doesn’t need any API key to get a decent amount of subdomains.
Cons
- Inconsistent in the time required to show results.
Results
Sources | Speed | Quantity |
---|---|---|
★★★☆☆ | ★★★☆☆ | ★★☆☆☆ |
WaybackUrls
- Url: https://github.com/tomnomnom/assetfinder
- Stars: 1,5K
- Language: Go
- Latest commit: 24 Apr 2020
- Sources supported: 3
WaybackMachine URL scraping tool. In this case, it can be used to filter subdomains from the URL list with unfurl.
Pros
- Really fast for the amount of data retrieved.
Cons
- Just get data from WaybackMachine service.
- It could have some features to filter the output or avoid certain extensions for example.
Results
Sources | Speed | Quantity |
---|---|---|
★★☆☆☆ | ★★★★★ | ★★☆☆☆ |
gau
- Url: https://github.com/lc/gau
- Stars: 1,6K
- Language: Go
- Latest commit: 15 Nov 2021
- Sources supported: 4
Similar to WaybackUrls with different sources, but the functionality is the same and the output needs to be filtered as well.
Pros
- Usually returns the same data as Waybackurls plus a few more results.
Cons
- Very inconsistent in the amount of data recovered.
- Slow for the amount of data returned.
Results
Sources | Speed | Quantity |
---|---|---|
★★★☆☆ | ★★☆☆☆ | ★★☆☆☆ |
github-subdomains
- Url: https://github.com/gwen001/github-subdomains
- Stars: 276
- Language: Go
- Latest commit: 15 Apr 2021
- Sources supported: 1
Tool to extract subdomains from the GitHub search function.
Pros
- Fast
- Most of the tools do not have GitHub as a source.
Cons
- The API needs a good amount of GitHub tokens to work quickly.
- Depending on the target it can take a long time.
Results
Sources | Speed | Quantity |
---|---|---|
★☆☆☆☆ | ★★★☆☆ | ★★★☆☆ |
findomain
- Url: https://github.com/Findomain/Findomain
- Stars: 2,1K
- Language: Rust
- Latest commit: 9 Nov 2021
- Sources supported: 14
Free and limited version of the paid version of Findomain. It has a decent amount of built-in fonts and a good balance between speed and data, it’s also the only tool written in Rust.
Pros
- Fast
- Frequent update
- Good amount of features in the free plan
Cons
- Few subdomains returned
Results
Sources | Speed | Quantity |
---|---|---|
★★★☆☆ | ★★★★☆ | ★★☆☆☆ |
OneForAll
- Url: https://github.com/shmilylty/OneForAll
- Stars: 4,1K
- Language: Python
- Latest commit: 19 Nov 2021
- Sources supported: 48
This was an unknown tool to me a few months ago and I was amazed at the big number of sources you can get.
Pros
- Lot of sources integrated
- Frequently updated
Cons
- Fewer subdomains than expected given the number of sources.
Results
Sources | Speed | Quantity |
---|---|---|
★★★★☆ | ★☆☆☆☆ | ★★★☆☆ |
DNS Resolving / Bruteforce
ShuffleDNS
- Url: https://github.com/projectdiscovery/shuffledns
- Stars: 692
- Language: Go
- Latest commit: 20 Oct 2021
It’s the DNS resolution tool developed by Project Discovery, I have been using it for a long time for brute force tasks.
Pros
- Many options to tune the scan
- Quite fast
- Massdns wrapper
Cons
- Trusted resolver not editable
- Bad wildcard management
- Sometimes crashes with large wordlists
Results
DNS Speed | DNS Quality |
---|---|
★★★★☆ | ★★★☆☆ |
Puredns
- Url: https://github.com/d3mondev/puredns
- Stars: 580
- Language: Go
- Latest commit: 25 Jun 2021
My preferred tool for DNS resolution and brute force, version 2 was released this year with a ton of improvements.
Pros
- Best wildcard filtering
- Almost the fastest
- The most accurate
Cons
- Could have multiple domains as targets
- No option to filter different DNS responses
Results
DNS Speed | DNS Quality |
---|---|
★★★★☆ | ★★★★★ |
dnsx
- Url: https://github.com/projectdiscovery/dnsx
- Stars: 629
- Language: Go
- Latest commit:19 Nov 2021
Again, another Project Discovery tool, but this time it’s focused on DNS responses, it’s like a modern dig replacement that can be used to resolve a large number of domains.
Pros
- Different DNS response filtering
- Raw output
- Multiple features about DNS requests
Cons
- Can’t run bruteforce
- Bad wildcard filtering
Results
DNS Speed | DNS Quality |
---|---|
★★★☆☆ | ★★☆☆☆ |
dnscan
- Url: https://github.com/rbsec/dnscan
- Stars: 643
- Language: Python
- Latest commit: 28 Oct 2021
A complete DNS toolkit written in Python with all the basic features and some extra features.
Pros
- Recursive brute force allowed
- Fairly accurate
- Failback to TXT and MX records
Cons
- No trusted resolvers
- No wildcard filtering
- No resolving, just bruteforce
Results
DNS Speed | DNS Quality |
---|---|
★★★★☆ | ★★★★☆ |
gobuster
- Url: https://github.com/OJ/gobuster
- Stars: 5,3K
- Language: Go
- Latest commit: 21 Jun 2021
Originally intended to be a web fuzzer, a new feature was added over a year ago to allow DNS bruteforce.
Pros
- Wildcard filtering
- Quality results
Cons
- List of custom resolvers not allowed
- Loss control with a large list of subdomains
- No resolving, just BF
Results
DNS Speed | DNS Quality |
---|---|
★★★☆☆ | ★★★★☆ |
aiodnsbrute
- Url: https://github.com/blark/aiodnsbrute
- Stars: 403
- Language: Python
- Latest commit: 4 Jun 2019
Non-maintained asynchronous DNS bruteforce tool written in Python, focused on speed according to the repository documentation.
Pros
- List of custom resolvers allowed.
- Different DNS records.
Cons
- Last commit 2019
- No wildcard checks.
Results
DNS Speed | DNS Quality |
---|---|
★★☆☆☆ | ★★★☆☆ |
massdns
- Url: https://github.com/blechschmidt/massdns
- Stars: 2,1K
- Language: C
- Latest commit: 11 Nov 2021
This tool is the core of many other tools as it offers the fastest DNS resolution in an incredibly short amount of time, some people use it instead of its wrappers.
Pros
- The fastest.
- Serves as a base and core for multiple tools.
- Trillions of options.
Cons
- Running independently needs heavy output processing
- No wildcard checks.
- No BF, just resolver.
Results
DNS Speed | DNS Quality |
---|---|
★★★★★ | ★★★☆☆ |
Rusolver
- Url: https://github.com/Edu4rdSHL/rusolver
- Stars: 136
- Language: Rust
- Latest commit: 20 Oct 2021
The Findomain developer released this DNS resolver as part of their main tool and it is also written in Rust.
Pros
- Wildcard checks.
- Allows resolving and BF.
Cons
- Useless with big wordlists
Results
DNS Speed | DNS Quality |
---|---|
★★★☆☆ | ★★★★☆ |
Alterations / Permutations
Altdns
- Url: https://github.com/infosec-au/altdns
- Stars: 1,6K
- Language: Python
- Latest commit: 10 Sept 2021
Another tool from a famous hacker, infosec-au is one of the most used tools for permutations developed in Python and regularly maintained.
Pros
- Thread control.
- It allows solving the generated list.
Cons
- No iteration of numbers
- Do not combine existing data
Results
Perm Speed | Perm Quantity | Perm Quality |
---|---|---|
★★★★☆ | ★★★☆☆ | ★★★★☆ |
dnscewl
- Url: https://github.com/codingo/DNSCewl
- Stars: 213
- Language: C++
- Latest commit: 7 Jun 2021
Again, another well-known guy from the bug bounty scene, a tool developed by codingo and developed in C++.
Pros
- Really fast
- Built-in word list
- Iterate numbers
- Append and prepend alterations
Cons
- Lose some combinations
- Crashes when the file is larger than 3GB
Results
Perm Speed | Perm Quantity | Perm Quality |
---|---|---|
★★★★☆ | ★☆☆☆☆ | ★★★★☆ |
gotator
- Url: https://github.com/Josue87/gotator
- Stars: 126
- Language: Go
- Latest commit: 24 Jul 2021
Tool developed by a good friend and colleague keeping in mind all the needs that a permutations tool should have.
Pros
- More complete options
- Thread control
- Built-in word list
- Depth control
- Avoid dupes and silly combinations.
Cons
- Slow
Results
Perm Speed | Perm Quantity | Perm Quality |
---|---|---|
★☆☆☆☆ | ★★★★★ | ★★★★★ |
dmut
- Url: https://github.com/bp0lr/dmut
- Stars: 99
- Language: Go
- Latest commit: 5 Jun 2021
Golang tool with an impressive effort in speed and a good balance in quality.
Pros
- The fastest
- Allows you to solve generated lists
- Thread control
Cons
- Lack of built-in wordlist
- Don’t iterate over numbers
Results
Perm Speed | Perm Quantity | Perm Quality |
---|---|---|
★★★★★ | ★★★☆☆ | ★★★☆☆ |
dnsgen
- Url: https://github.com/ProjectAnte/dnsgen
- Stars: 511
- Language: Python
- Latest commit: 24 Mar 2020
Probably one of the first tools of this type to become famous, it has a lot of different permutations which adds good quality results.
Pros
- Append and prepend words
- Iterate numbers
- Combine existing subdomains
Cons
- No threads control
- Creates dumb combinations
Results
Perm Speed | Perm Quantity | Perm Quality |
---|---|---|
★★☆☆☆ | ★★★★☆ | ★☆☆☆☆ |
Conclusion
After all these hours spent reviewing tools, subdomains, DNS requests, number of responses and other data, I have come to different conclusions that I will leave in the form of key points:
- It looks like Golang is finally starting to assert itself as an offensive development language against Python.
- The subdomain enumeration tools are doing their job better day by day, making the recognition process easier, which should be infinitely appreciated.
- It’s fine to develop your own tools, but if you plan to release them as open source to the community, think about whether you can improve on a tool that already exists before creating another one that is very similar to what already exists.
- Anyway, please keep contributing to the foss world.
Finally, I would like to remind that there are other subdomain enumeration techniques, some more manual, some more complicated or only applied to certain targets that deserve to be investigated and understood, such as Google Analytics ID, AzureAD tenant domains, code scraping, TLS protocol certificate analysis.
Now comes the winners:
Passive
🥇 Amass
🥈 Subfinder
🥉 Findomain
Amass continues having a huge advantage in terms of the number of integrated third parties and that is a key point in these tools, so from my point of view it is unbeatable. The rest of the winners obtain the position by the number of integrated sources which is directly related to the number of results.
DNS resolution / DNS Bruteforcing
🥇 Puredns
🥈 Dnscan
🥉 Shuffledns
The amount of options Puredns has to fine-tune DNS resolution, how fast it does it (at the cost of consuming bandwidth) and how focused it is on resolving subdomains effectively make it without a doubt the best DNS resolution tool for pentesters and bug hunters without a doubt. Dnscan has been a pleasant surprise for me as it has achieved a stability and quality of results that I did not expect, while shuffledns I think needs to be revised and improved in the filtering of wildcards and the accuracy of the results returned.
Alterations / Permutations
🥇 Gotator
🥈 Altdns
🥉 Dmut
In this case, all the tools in the top 3 have obtained the same number of stars, so I had to review the results in more detail. I have put Gotator in first place because the quality and quantity of results is far superior to the rest and although it is slower, it is not a value that seems to me as important as the quality of the result. As for altdns, I have put it in second place for the same reason, leaving dmut in third place.
End
I hope you enjoyed the review as much as I did writing it, do not hesitate to contact me through the channel you prefer, you will find me as six2dez and I will be happy to talk about any topic 🙂