caon

If you are going to use puredns get a nice list of resolvers, you can find them here:

https://github.com/felipecaon/resolvers

It is a list of already known and resolvered IPs but with a re-checking steps, I’ve found out that rechecking makes them less noisy because a lot of DNSes are configured to cloak results.

I have found some subs using this very same method you pointed. If you are going to use puredns do not forget to get a nice list of resolvers daily. Puredns does the first verification against your list of resolvers (so they can be less reliable) and the second check against verified ones (amazon, google).

If have daily updating resolvers in my…[Read more]

Agree that they can be noisy. But from a “I need to get paths that no one found” perspective, it does not makes any sense to use smaller lists – yeah, you should have a quick list to fire into every target to see what’s the deal – but apart than that, if you have concerns about WAFs, it is way better to use a distributed scanner…[Read more]

I is a good ideia if the target does not have WAF or any kind of control. I would use a distributed solution