Hands-On Penetration Testing with Kali NetHunter

Using DNSMAP

Another effective way to learn about subdomains, IP addresses, and build a picture or map of a network is through the use of DNSMAP. This utility is capable of performing several actions, but let's look at it right now as a way to learn about subdomains and associated IP addresses for a target.

You can use DNSMAP to perform any of the following actions:

• Find remote servers
• Find domain names that will allow you to map non-obvious/hard-to-find net blocks
• The ability to locate internal DNS names and IP addresses using brute-force

To use DNSMAP to locate subdomains, simply execute the following command:

dnsmap <domain name> 

For example, it will be seen like this:

dnsmap microsoft.com 

There is another tool that is effective at ...