After working on dnsmap for a few months whenever time allowed, I decided there were enough additional goodies to make version 0.30 a new public release.

Let me just say that a lot of the bugs that have been fixed, and features that have been added to this version would not be possible without the feedback from great folks such as Borys Lacki (www.bothunters.pl), Philipp Winter (7c0.org) and meathive (kinqpinz.info).

Thanks guys, your feedback was highly valuable to me.

new features

Anyways, the following are some of the new features included:

• IPv6 support
• Makefile included
• delay option (-d) added. This is useful in cases where dnsmap is killing your bandwidth
• ignore IPs option (-i) added. This allows ignoring user-supplied IPs from the results. Useful for domains which cause dnsmap to produce false positives
• changes made to make dnsmap compatible with OpenDNS
• disclosure of internal IP addresses (RFC 1918) are reported
• updated built-in wordlist
• included a standalone three-letter acronym (TLA) subdomains wordlist
• domains susceptible to “same site” scripting are reported
• completion time is now displayed to the user
• mechanism to attempt to bruteforce wildcard-enabled domains
• unique filename containing timestamp is now created when no specific output filename is supplied by user
• various minor bugs fixed

For those who have never used dnsmap, dnsmap is a command line tool originally released in 2006 which helps discover target subdomains and IP ranges during the initial stages of an infrastructure pentest. dnsmap is a passive(ish) discovery tool meant to be used before an actual active attack. It’s an alternative to other discovery techniques such as whois lookups, scanning large IP ranges, etc … Run dnsmap and you should be able spot netblocks of a target organization in a relatively short period of time.

dnsmap is open source and is known to work on Linux, FreeBSD and Windows using Cygwin, although it has mostly been tested on Linux.

The major drawback is lack of multi-threading support, which I’m hoping will be included in the next public release. Life is busy these days, but I’ll try to spend some time on this project when time allows and inspiration is available!

—
gnucitizen information security gigs part of the cutting-edge network:

• No active items found!
• GNUCITIZEN NETWORK

—
recent posts from the gnucitizen cutting-edge network:

Exit Through the Gift Shop
Jerry Rice on Success
Time Blocking
0.5 is up for grabs
Websecurify 0.5RC1 Is Available for Download

View full post on GNUCITIZEN

• Why you should get the latest version if you are using Acrobat Reader
  Since the 24th of February 2009 there is an exploit in the wild that affects all Adobe Reader versions 9.0 and earlier. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0658 Twice since then I h...
• Discover to get $5M from Heartland for ’08 data breach
  Heartland Payment Systems has agreed to pay $5 million to Discover to settle claims arising from the massive data breach disclosed by the payment processor last year. View full post on Computerworl...
• With GlavMed gone, who is the King of Pharm Spam?
  Last week the anti-spam community was abuzz with the news that Igor Gusev, the CEO of DespMedia, and the man behind GlavMed and SpamItDotBiz had been charged in absentia for running an unregulated int...
• Let’s Play Phantasmagoria 2 (Part 6)
  (You can watch parts 5-8 of this review uncut and in higher quality on my website.) I think there's something much more diabolically wrong with my computer than some ma...
• Identity Sharing… Multi-component phishing attempt?
  I am going to Turkey. Yes! Yes!! Yes!!! I won!!!! But eh… Wait a minute? I did not even know I participated in a lottery!?!?! How it all started… As I own some domains, I can create alm...
• Return from the Dead: Waledac/Storm Botnet Back on the Rise
  The e-mail spam panorama is definitely showing an interesting trend lately. If you follow the news you may have noticed that a drop in e-mail spam activity was reported in the last couple of months; ...
• Does cybercrime really cost UK society more than drugs?
  The UK government has today published a report into the cost of cybercrime, concluding that the overall cost to the UK economy from cybercrime is £27bn per year. Wow. £27 billion a year is a huge amou...
• Five Reasons to “Celebrate” National Cyber Security Awareness Month (PC World)
  PC World - It's that time of year again. The weather is turning cooler, football season has begun, Halloween is fast approaching. That can only mean one thing--it's National Cyber Security Awareness M...
• The cars knew even more
  Earlier this year Norman published a security article about how Google's Street View cars collected data from WiFi networks. Google then wrote on its blog: "(...) We collect the following info...
• iPad Still Vulnerable, Hackers Say in Refuting AT&T (NewsFactor)
  NewsFactor - The iPad could have more security flaws than the one found on AT&T's web site last week. In a posting Monday, hacker site Goatse Security said "all iPads are vulnerable" because of a weak...