Closed freb closed 5 years ago
dns-brute
is most likely not getting any updates since I switched to https://github.com/OWASP/Amass. The only update I would consider would be to just wrap amass, but I don't think that's even a great idea considering there isn't anything additional that makes sense for integration into nmap.
If a domain uses a wildcard to match on subdomains, all subdomain checks will succeed and you'll waste time waiting for the results.
I need to add in an explicit check for wildcards before performing the full scan. It is true that with a wild card, there are some subdomains that could have explicit entries that match instead of the the wildcard rule and return a different IP address, but in general, you may not want to check all domain names in the list.
To check if a wildcard is in use, do the following:
*.example.com
9786sfhiuoyase81.example.com
9786sfhiuoyase82.example.com
9786sfhiuoyase83.example.com
If the subdomain returns with an IP, the wildcard is most likely in use. If all three subdomain queries come back with the same IP as the wildcard, it is definitely use a wildcard.