DNS枚举工具fierce

fierce工具和DNSenum工具性质差不多，其fierce主要是对子域名进行扫描和收集信息的。使用fierce工具获取一个目标主机上所有IP地址和主机信息。执行命令如下所示：
root@kali:~# fierce -dns baidu.com
DNS Servers for baidu.com:
ns2.baidu.com
ns7.baidu.com
dns.baidu.com
ns3.baidu.com
ns4.baidu.com
Trying zone transfer first…
Testing ns2.baidu.com
Request timed out or transfer not allowed.
Testing ns7.baidu.com
Request timed out or transfer not allowed.
Testing dns.baidu.com
Request timed out or transfer not allowed.
Testing ns3.baidu.com
Request timed out or transfer not allowed.
Testing ns4.baidu.com
Request timed out or transfer not allowed.
Unsuccessful in zone transfer (it was worth a shot)
Okay, trying the good old fashioned way… brute force
Checking for wildcard DNS…
** Found 94050052936.baidu.com at 123.125.81.12.
** High probability of wildcard DNS.
Now performing 2280 test(s)…
10.11.252.74 accounts.baidu.com
172.22.15.16 agent.baidu.com
180.76.3.56 antivirus.baidu.com
10.81.7.51 ba.baidu.com
172.18.100.200bd.baidu.com
10.36.155.42 bh.baidu.com
10.36.160.22 bh.baidu.com
10.11.252.74 accounts.baidu.com
……省略部分内容
61.135.163.0-255 : 1 hostnames found.
61.135.165.0-255 : 1 hostnames found.
61.135.166.0-255 : 1 hostnames found.
61.135.185.0-255 : 1 hostnames found.
Done with Fierce scan: http://www.landui.com/fierce/
Found 133 entries.
Have a nice day.

用户也可以通过提供一个单词列表执行相同的操作，执行命令如下所示：
root@kali:~# fierce -dns baidu.com -wordlist hosts.txt /tmp/output.txt