Gobuster Section 2 of 13

DNS Subdomain Bruteforce

The dnsmode discovers subdomains by performing DNS resolution using a wordlist. It is one of the most important reconnaissance techniques for mapping an organization's full online presence.

Core Concepts

DNS Resolution Basics

The Domain Name System (DNS) translates human-readable domain names (like example.com) into IP addresses. Subdomains (like api.example.com, mail.example.com) are separate DNS records that point to different services, often on different servers.

Why Subdomain Enumeration Matters

Subdomains represent the full attack surface of an organization. A company might secure their main website but leave a staging environment, old API endpoint, or forgotten service exposed on a subdomain. These are prime targets for penetration testers and bug bounty hunters.

How Gobuster DNS Works

Gobuster takes each word from your wordlist and appends it to the target domain (word.example.com), then performs a DNS A record lookup. If the DNS server returns an IP address, the subdomain exists. If it returns NXDOMAIN, the subdomain does not exist.

DNS Enumeration Commands

Basic Subdomain Enumeration

Enumerates subdomains of example.com using a list of 5,000 common subdomains. This is a fast initial reconnaissance step that often reveals interesting targets.

bash

1gobuster dns -d example.com -w /usr/share/wordlists/subdomains-top1million-5000.txt

Large-Scale Enumeration

Uses a 20,000-word wordlist with 50 threads for broader coverage. Larger wordlists find more subdomains but take longer.

bash

1gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50

Save Results to File

Saves discovered subdomains to a file for further processing. The output file can be fed into other tools like Nmap, EyeWitness, or httpx for service identification.

bash

1gobuster dns -d example.com -w subdomains.txt -o dns-results.txt

Show IP Addresses

The -i flag shows the resolved IP address for each discovered subdomain. This helps you map the network infrastructure and identify cloud providers or CDNs.

bash

1gobuster dns -d example.com -w common.txt -i

Custom DNS Server

Specifies a custom DNS resolver. Using Google DNS (8.8.8.8) or Cloudflare (1.1.1.1) can bypass local DNS caching and provide more consistent results.

bash

1gobuster dns -d example.com -w common.txt --resolver 8.8.8.8

Important Considerations

Tip

Combine Gobuster DNS with amass or subfinder for passive subdomain discovery via certificate transparency logs, then use Gobuster for active brute-forcing.

Warning

Some DNS servers rate-limit queries. If you see many timeouts, reduce threads with -t 5 or use a different resolver.

Info

Wildcard DNS (where *.example.com resolves to the same IP) makes brute-forcing less useful. Use dig any *.example.com to check for wildcard records before scanning.

Next: Virtual Hosts Back