# Subdomain Brute Forcing

> Systematically discover hidden subdomains by automating DNS queries against wordlists, revealing exposed infrastructure and expanding attack surface visibility.

- **URL:** https://hackindex.io/services/dns/enumeration/subdomain-brute-forcing
- **Path:** DNS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/dns/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-07-10

Active brute forcing against internal or permissive resolvers reveals hidden infrastructure. Internal resolvers often answer for names that external DNS does not expose. Targets running split-horizon DNS maintain a separate namespace for internal clients. Any resolver that responds to arbitrary queries is a valid brute force target. Feed a wordlist as subdomain prefixes and collect every name that returns a response.

- **Manual dig loop** iterate a wordlist as subdomain prefixes and collect every resolved IP.
- **dnsenum** bundles brute force with zone transfer attempts and Google scraping in a single pass.
- **dnsrecon -t brt** wordlist brute force with per-hit IP output, ready to pipe into a port scanner.
- **NSEC/NSEC3 zone walking** enumerate zone entries via DNSSEC chains without a wordlist (NSEC) or crack hashes offline (NSEC3).
- **fierce** attempts zone transfer first, then brute forces and scans adjacent /24 blocks via reverse DNS.

## Manual Brute Force with dig

```bash
for sub in $(cat /path/to/wordlist.txt); do dig $sub.$DOMAIN @$TARGET_IP +short; done
```

Non-empty answers are valid subdomains. An empty response means the name does not exist in the zone. An IP address in the response confirms resolution. A CNAME chain pointing to an external provider is worth flagging as a potential subdomain takeover candidate. Collect every resolved address and run service discovery against it. Use the single-query form to verify a specific candidate before processing a full wordlist.

Single test:

```bash
dig testsub.$DOMAIN @$TARGET_IP +short
```

## dnsenum Brute Force

dnsenum bundles wordlist brute forcing with zone transfer attempts and Google scraping. Run --enum to combine all three into a single pass. It is slower than purpose-built tools but covers more ground in one command. If the zone transfer succeeds, the brute force phase becomes unnecessary.

```bash
dnsenum --enum -f /path/to/wordlist.txt $DOMAIN
dnsenum --dnsserver $TARGET_IP $DOMAIN
```

dnsenum reports A, MX, and NS records alongside brute-forced names. Specifying --dnsserver directs queries to the target resolver directly, which matters on internal networks where the authoritative server knows names that public DNS does not expose.

## dnsrecon Brute Force and Zone Walking

dnsrecon -t std queries for A, AAAA, NS, MX, SOA, and TXT records. Run this first to map the zone structure before committing to brute force. The --dnsserver flag forces all queries through a specific resolver. Standard records:

```bash
dnsrecon -d $DOMAIN -t std
dnsrecon -d $DOMAIN -t std --dnsserver $TARGET_IP
```

The -t brt mode tests each wordlist entry as a subdomain prefix against the target domain. Each hit comes back with the resolved IP. Pipe the result list into a port scanner for service discovery. Brute force:

```bash
dnsrecon -d $DOMAIN -t brt -D /path/to/wordlist.txt
```

DNSSEC NSEC records chain together sorted zone entries. Iterating those chains reveals every name in the zone without a wordlist. This only works on zones using plain NSEC. NSEC3 zones use hashed labels, which prevents direct enumeration but remains vulnerable to offline hash cracking against short or predictable names. Run zonewalk to determine whether the zone uses NSEC or NSEC3 before deciding how to continue. NSEC/NSEC3 walking:

```bash
dnsrecon -d $DOMAIN -t zonewalk
```

## fierce Subdomain Discovery

fierce attempts a zone transfer first, then brute forces with its built-in wordlist or a provided one. It resolves discovered names and queries for additional records within those subdomains recursively.

```bash
fierce --domain $DOMAIN
fierce --domain $DOMAIN --dns-servers $TARGET_IP
fierce --domain $DOMAIN --wide
```

The --wide flag scans the entire /24 block surrounding any resolved IP using reverse DNS lookups. This surfaces neighboring hosts that share infrastructure with discovered names but do not appear in the forward zone. Forcing queries through --dns-servers points fierce at an internal resolver, which often knows more than public DNS. Treat every discovered name and IP as a pivot point into further service enumeration.