security enabled verified low v1.0.0

fierce

DNS reconnaissance tool for locating non-contiguous IP space, subdomain brute forcing, and reverse DNS lookups.

📋 Live Preview 
fierce --domain {domain}
🌍 domain → example.com 
fierce --domain {domain}

Sandbox: execFile · Timeout: 300s

Capabilities

network.discovery.dns
network.discovery.subdomain
security.recon.dns
network.discovery.ip-range

Parameters

Name Type Required Default Description Aliases
domain string No - Domain name to test --domain
connect boolean No - Attempt HTTP connection to non-RFC 1918 hosts --connect
wide boolean No - Scan entire class C of discovered records --wide
traverse integer No - Scan N IPs before and after discovered records --traverse
search string No - Filter on these domains when expanding lookup --search
range string No - Scan an internal IP range in CIDR notation --range
delay integer No - Time to wait between lookups (seconds) --delay
subdomains string No - Use these subdomains --subdomains
subdomain-file file No - Use subdomains from this file (one per line) --subdomain-file
dns-servers string No - Use these DNS servers for reverse lookups --dns-servers
dns-file file No - Use DNS servers from this file --dns-file
tcp boolean No - Use TCP instead of UDP for DNS queries --tcp
dns_file boolean No - ] --dns-file, --tcp
h boolean No - show this help message and exit -h, --help

Artifacts

TypeDescriptionMIMESchemaTrust
security.recon.dns.recordsDiscovered DNS records and IP spacetext/plain-verified

Contract

Inputs

network.target.domain

Target domain name

Outputs

security.recon.dns.records

DNS records and discovered IP space

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

security.recon.dns.records

Consumes

network.target.domain

Resource Profile

ResourceValue
CPUlow
Memory32 MB
Networklow
Disk I/Olow

Examples

Basic DNS reconnaissance

fierce --domain example.com

Wide scan across entire class C ranges

fierce --domain example.com --wide

With HTTP connection checking

fierce --domain example.com --connect

Scan internal IP range

fierce --range 10.10.10.0/24

Custom subdomain wordlist

fierce --domain example.com --subdomain-file subdomains.txt

Use specific DNS servers

fierce --domain example.com --dns-servers 8.8.8.8 1.1.1.1

Traverse N addresses around discovered records

fierce --domain example.com --traverse 10

Use TCP for DNS queries

fierce --domain example.com --tcp

Documentation

Fierce — DNS Reconnaissance

Fierce is a DNS recon tool originally written by RSnake and rewritten in Python. It locates non-contiguous IP space by performing DNS zone transfers, subdomain brute forcing, and reverse DNS lookups to map a target's network footprint.

Key Capabilities

  • Subdomain discovery: Brute forces common subdomain names
  • IP space mapping: Identifies non-contiguous IP ranges
  • Wide scanning: Expands to scan entire class C networks
  • Reverse DNS: Maps IP blocks back to hostnames
  • Internal scanning: Scan RFC 1918 ranges for host discovery

Usage Examples

# Basic recon
fierce --domain example.com

# Wide scan with connectivity check
fierce --domain example.com --wide --connect

# Internal range scanning
fierce --range 10.10.10.0/24 --dns-servers 192.168.1.1

Related Tools

dnsenumdnsreconamasssubfinder

References