dnsenum可用于信息收集->DNS分析
如果待查域名沒有ip地址，需要先查詢域名對應的ip地址，將域名對應的ip在unix主機上用到dig命令查出來，將含a或cname記錄的ip地址記錄到一個臨時文本文件中，然后將域名與ip地址用sql查詢聯(lián)系到一起，再根據(jù)ip地址查詢歸屬地域。2）建立反向查詢區(qū)域：反向查詢區(qū)域存放反向域名解析必需的記錄信息linux命令大全，提供給一些需要進行反向域名解析的應用。悠游域名批量查詢工具是一款域名批量查詢工具，可根據(jù)規(guī)則生成查詢，可查詢域名的注冊信息、備案信息、權重信息，還可以查詢過期域名。
dnsenum是一個perl腳本，腳本文件獲取：?name=dnsenum.pl&can=2&q=
腳本源碼地址：
下載后是一個叫dnsenum.pl的perl腳本。當然kali里是自帶的，你可以直接用。
官方幫助
dnsenum VERSION:1.2.4
Usage: dnsenum [Options] <domain>
[Options]:
Note: the brute force -f switch is obligatory.
GENERAL OPTIONS:
--dnsserver <server>
Use this DNS server for A, NS and MX queries.
--enum Shortcut option equivalent to --threads 5 -s 15 -w.
-h, --help Print this help message.
--noreverse Skip the reverse lookup operations.
--nocolor Disable ANSIColor output.
--private Show and save private ips at the end of the file domain_ips.txt.
--subfile <file> Write all valid subdomains to this file.
-t, --timeout <value> The tcp and udp timeout values in seconds (default: 10s).
--threads <value> The number of threads that will perform different queries.
-v, --verbose Be verbose: show all the progress and all the error messages.
GOOGLE SCRAPING OPTIONS:
-p, --pages <value> The number of google search pages to process when scraping names,
the default is 5 pages, the -s switch must be specified.
-s, --scrap <value> The maximum number of subdomains that will be scraped from Google (default 15).
BRUTE FORCE OPTIONS:
-f, --file <file> Read subdomains from this file to perform brute force.
-u, --update <a|g|r|z>
Update the file specified with the -f switch with valid subdomains.
a (all) Update using all results.
g Update using only google scraping results.
r Update using only reverse lookup results.
z Update using only zonetransfer results.
-r, --recursion Recursion on subdomains, brute force all discovred subdomains that have an NS record.
WHOIS NETRANGE OPTIONS:
-d, --delay <value> The maximum value of seconds to wait between whois queries, the value is defined randomly, default: 3s.
-w, --whois Perform the whois queries on c class network ranges.
**Warning**: this can generate very large netranges and it will take lot of time to performe reverse lookups.
REVERSE LOOKUP OPTIONS:
-e, --exclude <regexp>
Exclude PTR records that match the regexp expression from reverse lookup results, useful on invalid hostnames.
OUTPUT OPTIONS:
-o --output <file> Output in XML format. Can be imported in MagicTree (www.gremwell.com)
上一個教程：Linux服務器寶塔命令大全
下一個教程：linux常用命令(4)——用戶、權限
