Quick update: As @MikeDammpoints out, xargs has a -P option that can do the same thing I’m using parallel for. If you have a supported version of xargs you can use -P 0 to do the same thing as -j0 with parallel, but if your version doesn’t support the 0 you can simply use the same number parallel uses ala:
This results in roughly the same completion time as it’s parallel counterpart. Thanks @MikeDamm!
There are some great discussions on the NoVA Hackers mailing list. One such discussion was about what the best way to do dns hostname brute forcing was and which tool is better than another. For me, I just use the command line and then parse the results (or just ask the deepmagic.com database ;–)
Here is what I do:
First, you need a good list of DNS sub domains / hostnames. Personally I use the list provided over at http://www.ethicalhack3r.co.uk/zone-transfers-on-the-alexa-top-1-million/ (with a few minor tweaks). If you haven’t read that post and follow-on posts you really should. But take the list and save it locally. Then just run the following command:
Now, xargs is great but does one thing at a time and can be quite slow if your subdomains list is large. With the use of the amazing tool GNU parallel you can get done in a matter of seconds, well, that or knock over your home router.
Warning: the -j0 option maxes out the possible file handles and jobs that your CPU/kernel can handle, which usually destroys VMs. Just a smaller job count like 100 or 50 if you want the speed without the crash ;–)
parallel: Warning: Only enough file handles to run 122 jobs in parallel.Raising ulimit -n or /etc/security/limits.conf may help.parallel: Warning: No more file handles. Raising ulimit -n or /etc/security/limits.conf may help.mail.microsoft.com. 2369 IN A 131.107.125.5www.microsoft.com. 0 IN CNAME toggle.www.ms.akadns.net.toggle.www.ms.akadns.net. 0 IN CNAME g.www.ms.akadns.net.g.www.ms.akadns.net. 0 IN CNAME lb1.www.ms.akadns.net.lb1.www.ms.akadns.net. 263 IN A 64.4.11.42m.microsoft.com. 0 IN CNAME origin.mobile.ms.akadns.net.origin.mobile.ms.akadns.net. 300 IN A 65.55.186.235ftp.microsoft.com. 0 IN CNAME ftp.microsoft.akadns.net.ftp.microsoft.akadns.net. 259 IN A 64.4.17.176mobile.microsoft.com. 0 IN CNAME origin.mobile.ms.akadns.net.origin.mobile.ms.akadns.net. 300 IN A 65.55.186.235smtp.microsoft.com. 3600 IN A 131.107.115.215smtp.microsoft.com. 3600 IN A 131.107.115.214smtp.microsoft.com. 3600 IN A 205.248.106.64smtp.microsoft.com. 3600 IN A 205.248.106.30smtp.microsoft.com. 3600 IN A 205.248.106.32smtp.microsoft.com. 3600 IN A 131.107.115.212search.microsoft.com. 0 IN CNAME search.microsoft.akadns.net.search.microsoft.akadns.net. 0 IN CNAME search.msn.com.edgesuite.net.search.msn.com.edgesuite.net. 0 IN CNAME a134.g.akamai.net.a134.g.akamai.net. 19 IN A 209.107.220.27a134.g.akamai.net. 19 IN A 209.107.220.35dev.microsoft.com. 0 IN CNAME msdn.microsoft.com.msdn.microsoft.com. 0 IN CNAME msdn.microsoft.akadns.net.msdn.microsoft.akadns.net. 600 IN A 157.56.148.19img.microsoft.com. 0 IN CNAME i.microsoft.com.edgesuite.net.i.microsoft.com.edgesuite.net. 0 IN CNAME a1475.g.akamai.net.a1475.g.akamai.net. 20 IN A 165.254.158.48a1475.g.akamai.net. 20 IN A 165.254.158.9news.microsoft.com. 0 IN CNAME msnews.microsoft.com.msnews.microsoft.com. 3600 IN A 207.46.248.16mail2.microsoft.com. 3600 IN A 131.107.115.215beta.microsoft.com. 0 IN CNAME connect.microsoft.akadns.net.connect.microsoft.akadns.net. 300 IN A 65.52.103.84support.microsoft.com. 0 IN CNAME mso-geo.microsoft.akadns.net.mso-geo.microsoft.akadns.net. 0 IN CNAME support.microsoft.akadns.net.support.microsoft.akadns.net. 175 IN A 157.56.56.139my.microsoft.com. 3600 IN A 134.170.255.29help.microsoft.com. 0 IN CNAME help.msn.com.mail3.microsoft.com. 3600 IN A 131.107.115.214download.microsoft.com. 0 IN CNAME download.microsoft.com.nsatc.net.download.microsoft.com.nsatc.net. 0 IN CNAME main.dl.ms.akadns.net.main.dl.ms.akadns.net. 0 IN CNAME download.microsoft.com.edgesuite.net.download.microsoft.com.edgesuite.net. 0 IN CNAME a954.dscms.akamai.net.a954.dscms.akamai.net. 0 IN CNAME a954.dscms.akamai.net.0.1.cn.akamaitech.net.a954.dscms.akamai.net.0.1.cn.akamaitech.net. 1 IN A 69.31.75.184a954.dscms.akamai.net.0.1.cn.akamaitech.net. 1 IN A 69.31.75.168shop.microsoft.com. 3600 IN A 64.4.11.37shop.microsoft.com. 3600 IN A 65.55.58.201games.microsoft.com. 3600 IN A 207.46.166.10business.microsoft.com. 3600 IN A 65.55.57.98ws.microsoft.com. 0 IN CNAME ws.microsoft.com.nsatc.net.gateway.microsoft.com. 3600 IN A 131.107.16.142gateway.microsoft.com. 3600 IN A 131.107.16.143members.microsoft.com. 0 IN CNAME members.microsoft.akadns.net.members.microsoft.akadns.net. 219 IN A 65.55.57.28c.microsoft.com. 0 IN CNAME c.microsoft.akadns.net.c.microsoft.akadns.net. 215 IN A 65.55.58.199g.microsoft.com. 0 IN CNAME g.msn.com.g.msn.com. 0 IN CNAME g.msn.com.nsatc.net.g.msn.com.nsatc.net. 142 IN A 131.253.34.154mail4.microsoft.com. 3600 IN A 205.248.106.64mail1.microsoft.com. 3600 IN A 131.107.115.212apps.microsoft.com. 0 IN CNAME apps.windows.akadns.net.apps.windows.akadns.net. 0 IN CNAME services.windows.akadns.net.services.windows.akadns.net. 0 IN CNAME services-perf.windows.akadns.net.services-perf.windows.akadns.net. 46 IN A 134.170.30.204email.microsoft.com. 1989 IN A 157.55.150.73i.microsoft.com. 0 IN CNAME i.toggle.www.ms.akadns.net.i.toggle.www.ms.akadns.net. 0 IN CNAME i.g.www.ms.akadns.net.i.g.www.ms.akadns.net. 0 IN CNAME i.microsoft.com.edgesuite.net.i.microsoft.com.edgesuite.net. 0 IN CNAME a1475.g.akamai.net.a1475.g.akamai.net. 8 IN A 23.62.111.114a1475.g.akamai.net. 8 IN A 23.62.111.104s.microsoft.com. 0 IN CNAME reroute.microsoft.com.reroute.microsoft.com. 3600 IN A 64.4.11.37reroute.microsoft.com. 3600 IN A 65.55.58.201community.microsoft.com. 0 IN CNAME communities.microsoft.com.communities.microsoft.com. 3600 IN A 64.4.11.37communities.microsoft.com. 3600 IN A 65.55.58.201connect.microsoft.com. 0 IN CNAME connect.microsoft.akadns.net.connect.microsoft.akadns.net. 152 IN A 65.52.103.84rss.microsoft.com. 796 IN A 65.55.58.201rss.microsoft.com. 796 IN A 64.4.11.37home.microsoft.com. 0 IN CNAME redir.blu.cb3.glbdns.microsoft.com.redir.blu.cb3.glbdns.microsoft.com. 116 IN A 65.55.206.229jp.microsoft.com. 3600 IN A 65.55.58.201jp.microsoft.com. 3600 IN A 64.4.11.37labs.microsoft.com. 3600 IN A 64.4.11.37labs.microsoft.com. 3600 IN A 65.55.58.201exchange.microsoft.com. 2120 IN A 65.55.31.35marketing.microsoft.com. 3600 IN A 207.46.242.110mac.microsoft.com. 3600 IN A 64.4.11.37mac.microsoft.com. 3600 IN A 65.55.58.201feeds.microsoft.com. 3600 IN A 65.55.57.98partners.microsoft.com. 0 IN CNAME pmc.partners.microsoft.akadns.net.pmc.partners.microsoft.akadns.net. 300 IN A 131.107.119.14feed.microsoft.com. 0 IN CNAME feed.trafficmanager.net.feed.trafficmanager.net. 0 IN CNAME feedna.cloudapp.net.feedna.cloudapp.net. 10 IN A 65.52.9.172partner.microsoft.com. 0 IN CNAME portal.partners.microsoft.akadns.net.portal.partners.microsoft.akadns.net. 300 IN A 131.107.119.163cs.microsoft.com. 0 IN CNAME wedcs.trafficmanager.net.wedcs.trafficmanager.net. 0 IN CNAME wedcseus.cloudapp.net.wedcseus.cloudapp.net. 10 IN A 137.116.48.250forums.microsoft.com. 0 IN CNAME forums.microsoft.akadns.net.forums.microsoft.akadns.net. 600 IN A 65.52.103.99meet.microsoft.com. 3600 IN A 131.107.1.71e.microsoft.com. 3600 IN A 191.234.1.50autodiscover.microsoft.com. 2358 IN A 131.107.125.5im.microsoft.com. 3600 IN A 131.107.1.75sip.microsoft.com. 2228 IN A 65.55.30.130me.microsoft.com. 0 IN CNAME edm.cloudapp.net.dig: 'm..microsoft.com' is not a legal name (empty label)billing.microsoft.com. 0 IN CNAME paymenthubprod.trafficmanager.net.paymenthubprod.trafficmanager.net. 0 IN CNAME paymenthubuxprod1.cloudapp.net.paymenthubuxprod1.cloudapp.net. 10 IN A 168.62.198.20profile.microsoft.com. 0 IN CNAME profile.microsoft.akadns.net.profile.microsoft.akadns.net. 335 IN A 64.4.11.47research.microsoft.com. 806 IN A 131.107.65.14sharepoint.microsoft.com. 3463 IN A 64.4.6.100sharepoint.microsoft.com. 3463 IN A 65.55.39.10appdev.microsoft.com. 0 IN CNAME appdev.windows.akadns.net.appdev.windows.akadns.net. 131 IN A 134.170.30.200newsletters.microsoft.com. 3150 IN A 207.46.248.35advertising.microsoft.com. 0 IN CNAME advertising.microsoft.com.nsatc.net.advertising.microsoft.com.nsatc.net. 245 IN A 65.52.100.46catalog.microsoft.com. 0 IN CNAME genuine.microsoft.akadns.net.genuine.microsoft.akadns.net. 300 IN A 65.55.58.177social.microsoft.com. 0 IN CNAME lb.social.ms.akadns.net.lb.social.ms.akadns.net. 54 IN A 65.52.103.78events.microsoft.com. 1776 IN A 64.4.11.31events.microsoft.com. 1776 IN A 65.55.58.192ajax.microsoft.com. 0 IN CNAME mscomajax.vo.msecnd.net.mscomajax.vo.msecnd.net. 208 IN A 65.54.81.164mscomajax.vo.msecnd.net. 208 IN A 65.54.81.12developer.microsoft.com. 0 IN CNAME msdn.microsoft.com.msdn.microsoft.com. 0 IN CNAME msdn.microsoft.akadns.net.msdn.microsoft.akadns.net. 600 IN A 157.56.148.19bbs.microsoft.com. 0 IN CNAME transfer.microsoft.com.transfer.microsoft.com. 3600 IN A 64.4.10.152backoffice.microsoft.com. 3600 IN A 64.4.11.37backoffice.microsoft.com. 3600 IN A 65.55.58.201