⚠️ Overview

DNSScanner is a reconnaissance tool primarily used for DNS enumeration, subdomain discovery, and zone transfer testing. Originally developed by security researcher rverton and published on GitHub under the repository DNSScanner, it has been forked and modified by multiple threat actors for malicious pre‑attack footprinting. While the official version is intended for legitimate security testing, numerous variants have been weaponised to automate DNS brute‑forcing against web applications, often without authorisation.

🔧 Technical Capabilities

DNSScanner performs multiple DNS record lookups (A, AAAA, MX, CNAME, TXT, NS, SOA) to map a target’s infrastructure. It supports dictionary‑based subdomain brute‑forcing using common wordlists (e.g., SecLists) and can attempt DNS zone transfers if the target’s nameserver misconfigurations are present. The tool also queries Certificate Transparency logs via crt.sh and uses services like VirusTotal and Shodan to enrich discovered subdomains. On successful enumeration, it outputs a structured report including IP addresses, mail servers, and potential wildcard DNS entries. Advanced variants include parallel threading (typically 50‑100 threads) to accelerate scanning, and some forks add JSON export for integration with other attack frameworks like Metasploit.

📜 History & Notable Incidents

The original DNSScanner repository was first committed in 2016 and remains available under an MIT license. Its misuse was documented in multiple penetration testing reports, including a 2019 JPCERT/CC advisory that identified DNSScanner as one of the most common tools used in pre‑attack reconnaissance against Japanese financial applications. In 2021, a modified version was observed by Unit 42 researchers in a campaign targeting cloud‑native environments, where it was used to enumerate exposed internal DNS servers (CVE‑2021‑39184 related to DNS amplification attacks). Academic research from 2023 at Black Hat cited DNSScanner as a key tool in subdomain takeover chains.

🔍 Detection Indicators

DNSScanner sends queries with a distinctive User‑Agent string: DNSScanner/1.0 (Python requests) or Mozilla/5.0 (compatible; DNSScanner/2.0) in modified versions. Behaviourally, it generates a high volume of DNS queries for non‑existent subdomains within minutes, often with a predictable pattern of increasing subdomain length. Network logs show rapid‑fire NXDOMAIN responses followed by A‑record lookups from a single source IP, typically over UDP port 53.

☠️ Risk & Impact

Successful enumeration by DNSScanner can expose internal hostnames, mail server configurations, and cloud‑specific subdomains (e.g., .s3.amazonaws.com), enabling attackers to launch targeted attacks like credential stuffing, phishing against specific employees, or subdomain takeover. If zone transfers are enabled, attackers can download the entire DNS zone file, revealing all network infrastructure, including VPN gateways and internal load balancers.

🛡️ Mitigation

DNSScanner is blocked immediately on detection because its reconnaissance activity violates rate‑limiting policies and provides attackers with a comprehensive attack surface map within minutes. Blocking the known User‑Agent strings and applying strict DNS query rate limits on authoritative servers effectively neutralises its reconnaissance phase.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.