fierce

• How To - Fierce Domain Scanner in Kali Linux 2.0
• Fierce is a System Reconnaissance tool used for scanning and collecting crucial information about the target domain
• Attackers can use this tool to enumerate subdomains related to the target domain
• It also enables them to identify non-contiguous IP spaces and hostnames that are linked with specified domains or subdomains
• attackers can create a network environment and identify the potential targets for exploitation

perl fierce.pl -dns <domain_name>

fierce -d example.com

It does,

• DNS Enumeration
• Zone Transfer Attempt
• Brute-Force Subdomains
• Resolve Hosts
• Identify Non-Contiguous IPs

Fierce is identified in the sources as a powerful DNS reconnaissance tool utilized in the footprinting and reconnaissance phases of ethical hacking. It is categorized among DNS interrogation tools used by attackers to query DNS servers and perform DNS footprinting.

Key Functionality and Purpose of Fierce

The main objectives and capabilities of the Fierce tool include:

1. Subdomain enumeration: Fierce is used by attackers to enumerate subdomains related to the target domain.
2. Identifying IP Spaces: A critical function of Fierce is to identify non-contiguous IP spaces and hostnames linked with specific domains or subdomains.
3. Mapping the Network: By gathering this information (subdomains and associated non-contiguous IP spaces), attackers are able to create a network environment map, which helps them identify potential targets for exploitation.

Example Usage of Fierce

Attackers can use various commands with Fierce to perform detailed DNS reconnaissance:

• Basic Scan: To perform a basic scan on a target domain, the command fierce --domain certifiedhacker.com can be run.
• Scanning Specific Subdomains: Attackers can scan a target domain to obtain specific subdomains by using the -subdomains option (e.g., scanning for subdomains containing words such as write, admin, and mail).
• Traversing IP Blocks: The tool can be instructed to search for contiguous blocks of IPs near discovered records using the --traverse option. For example, fierce --domain certifiedhacker.com --subdomains mail --traverse 10 searches within a range of 10 IP addresses.
• Connecting to Discovered Domains: Fierce can attempt an HTTP connection on the discovered domains of the target using the --connect option.
• Full Detailed Scan: A full detailed scan, encompassing all discovered records, can be performed using the --wide option.