Skip to content
Deepak Gupta markRecon Atlas

DNS resolution and enumeration

Fierce

Python DNS reconnaissance tool that tries a zone transfer, guesses subdomains, and scans nearby IPs to find non-contiguous IP space.

ActiveLow activityScope a pentestAudit your own exposure

1.8k stars · last push August 28, 2024 · GPL-3.0

GitHub repository

No commits in over a year (last push August 28, 2024). It may still work; check open issues before relying on it.

What it finds

Fierce looks up a domain's NS and SOA records, attempts a zone transfer against the SOA master, then checks for wildcards and resolves subdomains from a wordlist. For each hit it reverse-resolves nearby IPs to reveal related hosts and address blocks.

  • subdomains
  • IP addresses
  • nearby hostnames
  • zone transfer records

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

Default run (fierce.py): queries NS and SOA, attempts a zone transfer against the SOA master, brute forces names from default.txt, then reverse-resolves IPs near each hit (--traverse default 5). --connect adds an HTTP connection to non-RFC 1918 hosts.

API keys: The README documents no API keys; it relies only on DNS queries.

Install

Install with pip
python -m pip install fierce

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Check a domain with a few chosen subdomains
fierce --domain example.com --subdomains accounts admin ads

From the project's documentation

Search the whole /24 around each discovered host
fierce --domain example.com --wide

From the project's documentation

Try an HTTP connection to discovered hosts
fierce --domain example.com --subdomains mail --connect

From the project's documentation

Scan an internal range with an internal DNS server
fierce --dns-servers 192.0.2.1 --range 192.0.2.0/24

From the project's documentation

Output formats: stdout

Limits the project documents

  • The README notes zone transfers are rare these days.
  • Results go to stdout; saving them means redirecting output to a file.

Deepak's take

Analysis, not documentation

Use it when
Use it to check whether your name servers allow zone transfers and to find related hosts in IP space around known records.
Skip it when
Skip it for large wordlists; massdns or shuffledns resolve far faster. For passive collection use subfinder.
What it will miss
It will not find names outside its wordlist, or hosts whose IPs lack PTR records, unless a zone transfer succeeds.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. Fierce is a trademark or project name of its owners; this library is not affiliated with it.