DOMAINIM

Features • Usage • Installation • Usage • Contributing • Additional Notes

Domainim is a fast domain reconnaissance tool for organizational network scanning. The tool aims to provide a brief overview of an organization's structure using techniques like OSINT, bruteforcing, DNS resolving etc.

Features

Current features (v1.3.0)-

Subdomain enumeration (6 engines + bruteforcing). Engines are queried concurrently-
User-friendly output
Resolving A records (IPv4)

Virtual hostname enumeration
Reverse DNS lookup
Detects wildcard subdomains. Passive results that resolve only to the wildcard IPs are hidden unless they were seen in a TLS certificate. Bruteforcing can be forced with --force-brute, in which case results resolving only to the wildcard IPs are discarded
Basic TCP port scanning
Subdomains are accepted as input
Export results to JSON file

A few features are work in progress. See Planned features for more details.

The project is inspired by Sublist3r. The port scanner module is heavily based on NimScan.

Installation

You can build this repo from source-

Clone the repository

git clone [email protected]:pptx704/domainim

Build the binary

nimble build

Run the binary

./domainim <domain> [--ports=<ports>]

Or, you can just download the binary from the release page. Keep in mind that the binary is tested on Debian based systems only.

Usage

./domainim <domain> [--ports=<ports> | -p:<ports>] [--wordlist=<filename> | -l:<filename> [--rps=<int> | -r:<int>] [--force-brute | -f]] [--dns=<dns> | -d:<dns>] [--out=<filename> | -o:<filename>]

<domain> is the domain to be enumerated. It can be a subdomain as well.
-- ports | -p is a string speicification of the ports to be scanned. It can be one of the following-
- all - Scan all ports (1-65535)
- none - Skip port scanning (default)
- t<n> - Scan top n most common ports (same as nmap). i.e. t100 scans top 100 ports. Max value is 5000. If n is greater than 5000, it will be set to 5000.
- single value - Scan a single port. i.e. 80 scans port 80
- range value - Scan a range of ports. i.e. 80-100 scans ports 80 to 100
- comma separated values - Scan multiple ports. i.e. 80,443,8080 scans ports 80, 443 and 8080
- combination - Scan a combination of the above. i.e. 80,443,8080-8090,t500 scans ports 80, 443, 8080 to 8090 and top 500 ports
--dns | -d is the address of the dns server. This should be a valid IPv4 address and can optionally contain the port number-
- a.b.c.d - Use DNS server at a.b.c.d on port 53
- a.b.c.d#n - Use DNS server at a.b.c.d on port n
--wordlist | -l - Path to the wordlist file. This is used for bruteforcing subdomains. If the file is invalid, bruteforcing will be skipped. Empty lines and lines starting with # are ignored. You can get a wordlist from SecLists. A wordlist is also provided in the release page.
--force-brute | -f - Bruteforce even if a wildcard record is found. Subdomains that resolve only to the wildcard IPs are discarded.
--rps | -r - Number of requests to be made per second during bruteforce. The default value is 1024 req/s. It is to be noted that, DNS queries are made in batches and next batch is made only after the previous one is completed. Since quries can be rate limited, increasing the value does not always guarantee faster results.
--out | -o - Path to the output file. The output will be saved in JSON format. The filename must end with .json.

Examples

./domainim nmap.org --ports=all
./domainim google.com --ports=none --dns=8.8.8.8#53
./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt --rps=1500
./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt --out=results.json
./domainim nmap.org --wordlist=wordlist.txt --force-brute
./domainim mysite.com --ports=t50,5432,7000-9000 --dns=1.1.1.1

The help menu can be accessed using ./domainim --help or ./domainim -h.

Usage:
    domainim <domain> [--ports=<ports> | -p:<ports>] [--wordlist=<filename> | -l:<filename> [--rps=<int> | -r:<int>] [--force-brute | -f]] [--dns=<dns> | -d:<dns>] [--out=<filename> | -o:<filename>]
    domainim (-h | --help)

Options:
    -h, --help              Show this screen.
    -p, --ports             Ports to scan. [default: `none`]
                            Can be `all`, `none`, `t<n>`, single value, range value, combination
    -l, --wordlist          Wordlist for subdomain bruteforcing. Bruteforcing is skipped for invalid file.
    -f, --force-brute       Bruteforce even if a wildcard record is found. Results resolving only to wildcard IPs are discarded.
    -d, --dns               IP and Port for DNS Resolver. Should be a valid IPv4 with an optional port [default: system default]
    -r, --rps               DNS queries to be made per second [default: 1024 req/s]
    -o, --out               JSON file where the output will be saved. Filename must end with `.json`

Examples:
    domainim domainim.com -p:t500 -l:wordlist.txt --dns:1.1.1.1#53 --out=results.json
    domainim sub.domainim.com --ports=all --dns:8.8.8.8 -l:wordlist.txt -r:1500 -f -o:results.json

The JSON schema for the results is as follows-

[
  {
    "subdomain": string,
    "data": [
      {
        "ipv4": string,
        "vhosts": [string],
        "reverse_dns": string,
        "ports": [int]
      }
    ]
  }
]

Example json for nmap.org can be found here.

Contributing

Contributions are welcome. Feel free to open a pull request or an issue.

Planned Features

Others

Update verbose output when encountering errors (v0.2.0)
Show progress bar for longer operations
Add individual port scan progress bar
Add tests
Add comments and docstrings

Additional Notes

This project is still in its early stages. There are several limitations I am aware of.

domainim

Most Popular