You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support.
29
+
`shuffleDNS` is a wrapper around `massdns`, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomains with wildcard handling and easy input-output support.
30
30
31
31
Based on the work on `massdns` project by [@blechschmidt](https://github.com/blechschmidt).
-d, -domain string Domain to find or resolve subdomains for
56
+
-l, -list string File containing list of subdomains to resolve
57
+
-w, -wordlist string File containing words to bruteforce for domain
58
+
-r, -resolver string File containing list of resolvers for enumeration
59
+
-ri, -raw-input string Validate raw full massdns output
60
+
61
+
RATE-LIMIT:
62
+
-t int Number of concurrent massdns resolves (default 10000)
63
+
64
+
OUTPUT:
65
+
-o, -output string File to write output to (optional)
66
+
-j, -json Make output format as ndjson
67
+
-wo, -wildcard-output string Dump wildcard ips to output file
68
+
69
+
CONFIGURATIONS:
70
+
-m, -massdns string Path to the massdns binary
71
+
-mcmd, -massdns-cmd string Optional massdns commands to run (example '-q -i 10')
72
+
-directory string Temporary directory for enumeration
73
+
74
+
OPTIMIZATIONS:
75
+
-retries int Number of retries for dns enumeration (default 5)
76
+
-sw, -strict-wildcard Perform wildcard check on all found subdomains
77
+
-wt int Number of concurrent wildcard checks (default 25)
78
+
79
+
DEBUG:
80
+
-silent Show only subdomains in output
81
+
-version Show version of shuffledns
82
+
-v Show Verbose output
83
+
-nc, -no-color Don't Use colors in output
84
+
```
70
85
71
86
<table>
72
87
<tr>
73
88
<td>
74
89
75
90
## Prerequisite
76
91
77
-
shuffledns requires massdns to be installed in order to perform its operations. You can see the install instructions at [massdns project](https://github.com/blechschmidt/massdns#compilation). If you place the binary in `/usr/bin/massdns` or `/usr/local/bin/massdns`, the tool will auto-detect the presence of the binary and use it. On windows, you need to supply the path to the binary for the tool to work.
92
+
`shuffledns` requires `massdns` to be installed in order to perform its operations. You can see the installation instructions at [massdns project](https://github.com/blechschmidt/massdns#compilation). If you place the binary in `/usr/bin/massdns` or `/usr/local/bin/massdns`, the tool will auto-detect the presence of the binary and use it. On Windows, you need to supply the path to the binary for the tool to work.
78
93
79
94
The tool also needs a list of valid resolvers. The [dnsvalidator](https://github.com/vortexau/dnsvalidator) project can be used to generate these lists. You also need to provide wordlist, you can use a custom wordlist or use the [commonspeak2-wordlist](https://s3.amazonaws.com/assetnote-wordlists/data/manual/best-dns-wordlist.txt).
80
95
@@ -84,19 +99,19 @@ The tool also needs a list of valid resolvers. The [dnsvalidator](https://github
84
99
85
100
## Installation Instructions
86
101
87
-
shuffledns requires `go1.17+` to install successfully. Run the following command to get the repo -
102
+
`shuffledns` requires `go1.17+` to install successfully. Run the following command to install the latest version:
88
103
89
104
```bash
90
105
go install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest
91
106
```
92
107
93
108
## Running shuffledns
94
109
95
-
**shuffledns** supports two types of operations.
110
+
`shuffledns` supports two types of operations:
96
111
97
-
<ins>**Subdomain resolving**</ins>
112
+
<ins>**Subdomain resolving**</ins>
98
113
99
-
To resolve a list of subdomains, you can pass the list of subdomains via the `list` option.
114
+
To resolve a list of subdomains, you can pass the list of subdomains via the `-list` option.
This uses the subdomains found passively by `subfinder` and resolves them with shuffledns returning only the unique and valid subdomains.
128
+
This uses the subdomains found passively by `subfinder` and resolves them with `shuffledns` returning only the unique and valid subdomains.
114
129
115
-
<ins>**Subdomain Bruteforcing**</ins>
130
+
<ins>**Subdomain Bruteforcing**</ins>
116
131
117
-
shuffledns also supports bruteforce of a target with a given wordlist. You can use the `w` flag to pass a wordlist which will be used to generate permutations that will be resolved using massdns.
132
+
`shuffledns` also supports bruteforce of a target with a given wordlist. You can use the `w` flag to pass a wordlist which will be used to generate permutations that will be resolved using massdns.
A special feature of shuffleDNS is its ability to handle multi-level DNS based wildcards and do it so with very less number of DNS requests. Sometimes all the subdomains will resolve which will lead to lots of garbage in the results. The way shuffleDNS handles this is it will keep track of how many subdomains point to an IP and if the count of the Subdomains increase beyond a certain small threshold, it will check for wildcard on all the levels of the hosts for that IP iteratively.
152
+
A special feature of `shuffleDNS` is its ability to handle multi-level DNS based wildcards, and do it so with a very reduced number of DNS requests. Sometimes all the subdomains would resolve, leading to lots of garbage in the results. The way `shuffleDNS` handles this is by keeping track of how many subdomains point to an IP, and if the number of subdomains increase beyond a certain small threshold, it checks for wildcard on all the levels of the hosts for that IP iteratively.
138
153
139
154
</td>
140
155
</tr>
141
156
</table>
142
157
143
158
### Notes
144
159
145
-
- Wildcard filter feature works with domain (-d) input only.
160
+
- Wildcard filter feature works with domain (`-d`) input only.
146
161
- Resolving or Brute-forcing only one operation can be done at a time.
147
162
148
163
### License
149
164
150
-
shuffledns is distributed under [MIT License](https://github.com/projectdiscovery/shuffledns/blob/master/LICENSE.md)
165
+
`shuffledns` is distributed under [GPL v3 License](https://github.com/projectdiscovery/shuffledns/blob/master/LICENSE.md)
0 commit comments