DOCSEARCHbyAlgolia
Submit Docs

dnstwist Documentation

repository·master·Indexed 26 days ago

https://github.com/elceef/dnstwist

A DNS fuzzing tool used to uncover lookalike domains for phishing, typosquatting, and brand impersonation. dnstwist generates domain permutations and verifies them via DNS, HTML similarity using Locality-Sensitive Hashing (LSH), and visual similarity via perceptual hashing (pHash). It provides a command-line interface and a Python API for automating the detection of registered domains and analyzing web page similarity.

Tokens
1.5K
Snippets
5
Records
11
Agent score
41%

What's inside dnstwist

  1. Quick start guide for dnstwist CLI

    master

    Use the dnstwist command to generate domain permutations and verify DNS records.

    Common tasks:

    • Filter registered domains only: dnstwist --registered domain.name
    • Use a dictionary for permutations: dnstwist --dictionary dictionaries/english.dict domain.name
    • Check specific TLDs: dnstwist --tld dictionaries/common_tlds.dict domain.name
    • Use specific fuzzing algorithms: dnstwist --fuzzers "homoglyph,hyphenation" domain.name
    • Perform GeoIP lookups: dnstwist --geoip domain.name (Requires $GEOLITE2_MMDB env var for GeoIP2 database).
    • Export results:
      • CSV: dnstwist --format csv domain.name | column -t -s,
      • JSON: dnstwist --format json domain.name | jq
      • Bare list (no DNS lookups): dnstwist --format list domain.name

    DNS Configuration: If your DNS server cannot handle high request volumes, specify an external server using --nameservers.

    dnstwist --registered domain.name

  2. Detect phishing with Fuzzy Hashing (LSH)

    master

    Enable HTML similarity detection using Locality-Sensitive Hashing (LSH). dnstwist fetches content from the responding HTTP server, normalizes the HTML, and compares its fuzzy hash to the original domain.

    • Enable LSH: dnstwist --lsh domain.name
    • Specify algorithm: Use tlsh instead of the default ssdeep with dnstwist --lsh tlsh domain.name
    • Target specific URLs:
      • Use a full/partial URL as the argument: dnstwist --lsh https://domain.name/owa/
      • Override the fetch URL: dnstwist --lsh --lsh-url https://different.domain/owa/ domain.name
    dnstwist --lsh domain.name

  3. Detect phishing with Perceptual Hashing (pHash)

    master

    If Chromium is installed, dnstwist can use headless mode to capture screenshots and calculate visual similarity (pHash) between the original and generated domains.

    • Enable pHash: dnstwist --phash domain.name
    • Save screenshots: dnstwist --phash --screenshots /tmp/domain domain.name

    Note: This requires significant memory due to multi-threaded browser usage.

    dnstwist --phash domain.name

  4. Install dnstwist

    master

    You can install dnstwist using several methods depending on your environment:

    Python PIP

    • For the full version with all dependencies: pip install dnstwist[full]
    • For the bare minimum: pip install dnstwist

    Git To run the latest code:

    git clone https://github.com/elceef/dnstwist.git
cd dnstwist
pip install .

    Package Managers

    • Debian/Ubuntu/Kali Linux: sudo apt install dnstwist
    • Fedora Linux: sudo dnf install dnstwist
    • Arch Linux (yay): yay -S dnstwist
    • macOS (Homebrew): brew install dnstwist

    Docker

    • Run official image: docker run -it elceef/dnstwist
    • Build local image: docker build -t dnstwist .
    • Build with pHash support: docker build -t dnstwist:phash --build-arg phash=1 .
    pip install dnstwist[full]

  5. Configure HTTP proxies for dnstwist

    master
    For all HTTP connections, dnstwist automatically detects and uses proxies via environment variables. It looks for variables named <scheme>_proxy (e.g., HTTP_PROXY, HTTPS_PROXY) in a case-insensitive manner. If both lowercase and uppercase versions exist, the lowercase version is preferred.

  6. Analyze web page similarity with LSH and pHash

    master

    To automate the detection of phishing sites, dnstwist can compare the content or visual appearance of generated domains against an original site.

    Fuzzy Hashing (LSH): Compares HTML code similarity.

    • --lsh [LSH]: Evaluate similarity using ssdeep (default) or tlsh.
    • --lsh-url URL: Specify the original web page URL to fetch for comparison.

    Perceptual Hashing (pHash): Compares visual similarity via screenshots.

    • -p, --phash: Render web pages and compare perceptual hashes.
    • --phash-url URL: Specify the original web page URL to render for comparison.
    • --screenshots DIR: Save web page screenshots into the specified directory.

  7. Use dnstwist CLI to find similar domain names

    master

    Run dnstwist followed by a target domain to generate permutations and check their DNS records. This helps detect typosquatters, phishing attacks, and brand impersonation.

    Basic Usage:

    dnstwist example.com

    Common Workflow Tips:

    • Filter for active threats: Use --registered to show only domains that are currently resolvable/registered, which significantly reduces noise for long domains.
    • Save results: Use -o FILE to save the output to a specific file.
    • Control performance: Use -t NUM to specify the number of threads to speed up the process.
    • Avoid DNS rate limiting: If your local DNS server cannot handle the high volume of requests, specify external DNS or DNS-over-HTTPS servers using --nameservers LIST (comma-separated).

  8. Expand domain permutations with dictionaries and TLDs

    master

    If the default fuzzing algorithms do not generate enough variants, you can extend the search using external files:

    • Dictionary-based generation: Use -d or --dictionary FILE to generate additional domains using words from a provided dictionary file.
    • TLD swapping: Use --tld FILE to generate additional domains by swapping the TLD using a list read from the provided file.

  9. Use the dnstwist Python API

    master

    You can consume dnstwist data directly in your Python code using dnstwist.run(). The arguments are similar to the CLI flags, and the function returns a list of dictionaries.

    Standard usage:

    import dnstwist
data = dnstwist.run(domain='domain.name', registered=True, format='null')

    Passive mode (permutations only, no DNS lookups): To operate passively, combine the list format with redirection to devnull:

    import dnstwist
data = dnstwist.run(domain='domain.name', format='list', output=dnstwist.devnull)

    Warning: dnstwist.run() spawns daemon threads.

    import dnstwist
data = dnstwist.run(domain='domain.name', registered=True, format='null')