How to Use the Command 'dnsmap' (with Examples)

The dnsmap command-line tool is widely used by network administrators and security professionals for uncovering potential subdomains linked to a given domain name. By identifying potential subdomains, users can assess security measures, understand organizational structures, or simply enhance the completeness of their network mapping tasks. This versatile tool can utilize an internal wordlist or a custom list of subdomains to scan, and it provides options for output management and handling false positives.

Use Case 1: Scan for Subdomains Using the Internal Wordlist

Code:

dnsmap example.com

Motivation: Running a scan for subdomains using the internal wordlist is one of the most straightforward applications of dnsmap. This is useful for individuals who need a quick assessment of what common subdomains might exist under a given domain. The tool’s internal wordlist contains a set of frequently used subdomains, which helps in detecting potential security vulnerabilities or in gaining a quick overview of a domain’s structure.

Explanation:

• dnsmap: This is the command-line tool being invoked.
• example.com: This is the target domain for which subdomains are being scanned.

Example Output:

192.0.2.1    mail.example.com
192.0.2.2    www.example.com
192.0.2.3    ftp.example.com

Use Case 2: Specify a List of Subdomains to Check For

Code:

dnsmap example.com -w path/to/wordlist.txt

Motivation: Specifying a custom wordlist allows users to tailor their subdomain search depending on unique needs or assumptions. This is especially useful for advanced users who want to incorporate specific subdomain names based on inside knowledge, industry jargon, or recent trends not covered by the standard wordlist. This approach offers heightened flexibility and potentially uncovers unique subdomains that might not be present in a generic wordlist.

Explanation:

• -w path/to/wordlist.txt: The -w flag indicates that a custom wordlist is being used, followed by the path to the text file containing subdomain names to be checked.

Example Output:

192.0.2.4    blog.example.com
192.0.2.5    admin.example.com

Use Case 3: Store Results to a CSV File

Code:

dnsmap example.com -c path/to/file.csv

Motivation: Exporting results to a CSV file makes the data easy to share, analyze, and store. This is particularly beneficial for comprehensive documentation tasks or when results need to be passed on to other team members or included in more extensive systems. CSV files are universally readable by various applications, from data processing scripts to spreadsheet software.

Explanation:

• -c path/to/file.csv: The -c flag specifies that output should be written to a specified CSV file, ensuring the results are stored safely and accessibly.

Example Output:

Subdomain,IP Address
mail.example.com,192.0.2.1
www.example.com,192.0.2.2

Use Case 4: Ignore 2 IPs That Are False Positives

Code:

dnsmap example.com -i 123.45.67.89,98.76.54.32

Motivation: Sometimes, scans return IP addresses that are false positives or are known not to belong to relevant subdomains, possibly due to common DNS misconfigurations or testing addresses. By ignoring specific IPs, the tool allows the user to focus on genuine results, streamlining the data and reducing post-processing work. This is crucial in environments with repeated false positives affecting accurate results.

Explanation:

• -i 123.45.67.89,98.76.54.32: The -i flag causes the tool to ignore up to five comma-separated IP addresses during the scan, aiding in cleaning up the output for more accurate scanning results.

Example Output:

192.0.2.6    store.example.com
192.0.2.7    dev.example.com

Conclusion

The dnsmap tool provides variable options for scanning subdomains, making it an effective asset in network security and reconnaissance tasks. Whether utilizing the internal wordlist or a custom one, outputting results into organized files, or filtering out false positives, these examples illustrate the flexibility and utility of dnsmap in practical scenarios. For users seeking to enhance their understanding and management of domain structures, mastering dnsmap offers significant operability and insight.