dnsbruter.sh

#!/usr/bin/env bash

# dnsbruter.sh
# A DNS subdomain finder
# Usage: $0 <-w WORDLIST> <-o OUTFILE> DOMAIN
# By: th3xer0
VERSION=1.6

echo "-*-*- dnsbruter ($VERSION) - DNS Subdomain Finder -*-*-"
echo
echo

while [[ $# -gt 1 ]]
	do
		key="$1"

		case $key in
			-w|--wordlist)
			WORDLIST="$2"
			shift
			;;
			-o|--outfile)
			OUTFILE="$2"
			shift
			;;
			*)
			;;
		esac
		shift
	done

if [ -z "$1" ]
	then
		echo "Usage: $0 <-w WORDLIST> <-o OUTFILE> DOMAIN"
		exit -1
	else
		DOMAIN=$1
fi

if [ -z "$WORDLIST" ]
	then
		WORDLIST="/usr/share/golismero/wordlist/dns/subbrute_large.txt"
fi

if [ -z "$OUTFILE" ]
	then
		OUTFILE=$DOMAIN\_dnsbruter\_results.txt
fi

echo "[+] Generating DNS Subdomain list for domain: $DOMAIN"
echo "[+] Using wordlist: $WORDLIST"
echo "[+] Saving to $OUTFILE"
echo "[+] Note: this may take some time depending on the size of the wordlist.  Go get some coffee."

echo $DOMAIN >> $OUTFILE

echo
echo
echo "[+] #1: Running nmap dns-brute script:"
nmap --script dns-brute --script-args dns-brute.threads=25,dns-brute.domain=$DOMAIN,dns-brute.hostlist=$WORDLIST -oA $DOMAIN\_nmap\_dns\-brute\_results
cat $DOMAIN\_nmap\_dns\-brute\_results.nmap | grep "|" | grep $DOMAIN | grep -v "^|_" | cut -d " " -f 6 | grep -v "^\." | sort | uniq >> $OUTFILE
cat $DOMAIN\_nmap\_dns\-brute\_results.nmap | grep "|" | grep $DOMAIN | grep "^|_" | cut -d " " -f 5 >> $OUTFILE


echo
echo
echo "[+] #2: Running default dnsmap:"
dnsmap $DOMAIN -c $DOMAIN\_dnsmap\_default\_results.csv
cat $DOMAIN\_dnsmap\_default\_results.csv | cut -d "," -f 1 | sort | uniq >> $OUTFILE

echo
echo
echo "[+] Deduping Results..."
START=$(cat $OUTFILE | wc -l)
cat $OUTFILE | sort | uniq > temp.txt && mv temp.txt $OUTFILE
COUNT=$(cat $OUTFILE | wc -l)
echo "[+] Done: $COUNT unique subdomain found."
echo
echo