Skip to content
HackIndex logo

HackIndex

Subdomain Brute Forcing

1 min read Jul 10, 2026

Active brute forcing against internal or permissive resolvers reveals hidden infrastructure.

Manual Brute Force with dig

for sub in $(cat /path/to/wordlist.txt); do dig $sub.$DOMAIN @@$TARGET_IP +short; done

Non-empty answers are valid subdomains.

Single test:

┌──(kali㉿kali)-[~]
└─$ dig testsub.$DOMAIN @$TARGET_IP +short

dnsenum Brute Force

┌──(kali㉿kali)-[~]
└─$ dnsenum --enum -f /path/to/wordlist.txt $DOMAIN
┌──(kali㉿kali)-[~]
└─$ dnsenum --dnsserver $TARGET_IP $DOMAIN

Includes AXFR and metadata.

dnsrecon Brute Force and Zone Walking

Standard records:

┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t std
┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t std --dnsserver $TARGET_IP

Brute force:

┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t brt -D /path/to/wordlist.txt

NSEC/NSEC3 walking:

┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t zonewalk

fierce Subdomain Discovery

┌──(kali㉿kali)-[~]
└─$ fierce --domain $DOMAIN
fierce --domain $DOMAIN --dns-servers $TARGET_IP
fierce --domain $DOMAIN --wide

Deep traversal for nested names.