A tool to bruteforce dumains!

Dumb works with a masked dumain for substitution. The dumain can have as many masks as you want as long as you pass the according wordlists. For example:

Using the mask DUMB.dumain.com and the following wordlists:

www
ftp
backoffice

Dumb will generate the following dumains for bruteforce:

www.dumain.com
ftp.dumain.com
backoffice.dumain.com

For subdumains, you can only pass dumain.com and dumb will understand as DUMB.dumain.com.

Using the same principle, you can pass as mask dumain.DUMB with the following wordlist:

com
net
org

Dumb will generate the following dumains for bruteforce:

dumain.com
dumain.net
dumain.org

To bruteforce everything you can pass the mask as "DUMB.DUMB.DUMB" passing three wordlists:

wordlist1   wordlist2   wordlist3
www         foo         com
ftp         bar         net

Dumb will generate:

www.foo.com
ftp.foo.com
www.bar.com
ftp.bar.com
www.foo.net
ftp.foo.net
www.bar.net
ftp.bar.net

Dumb receives the dumain mask as first parameter and the wordlists following. The number of wordlists must match the number of masks in the dumain. For example:

• One mask:
  $ dumb "DUMB.dumain.com" wordlists/foo.txt
• Two masks:
  $ dumb "DUMB.dumain.DUMB" wordlists/foo.txt wordlists/bar.txt
• Several masks:
  $ dumb "DUMB-DUMB-DUMB_DUMB.DUMB.DUMB" wordlists/foo_1.txt ... wordlists/foo_6.txt

If you don't want to build from source, you can use the docker version:

• docker run -it giovanifss/dumb "DUMB.dumain.com" subdomains.txt
  Also, if you want to test the newest code (beta) with improvements, use:
• docker run -it giovanifss/dumb:beta "DUMB.dumain.com" subdomains.txt
  Note that the beta may be unstable or do not perform well

All the wordlists in wordlists/ are inside the docker container in filesystem root /, this means that you can call dumb passing the wordlists name:

• docker run -it giovanifss/dumb "DUMB.dumain.com" (subdomains.txt|subdominios.txt|domain-endings.txt)

To work with local wordlists that aren't present inside the container, you can use docker volumes:
docker run -v local/wordlist.txt:/opt/wordlist.txt -it giovanifss/dumb "DUMB.dumain.com" /opt/wordlist.txt

If you want to build from source you will need stack:

• Enter in the project directory and run $ stack build.
• To execute: $ stack exec dumb "DUMB.dumain.com" wordlists/subdomains.txt

Note that some older versions of stack have some problems to build the project (Debian stack package, for example). Make sure you get the latest stack version.

Future planned features are:

• Argument parser support, for better configuration of the tool execution;
• Post analysis of found dumains, generating statistics and metrics;

The tool performance will highly depend on your network connection. Usually, it should take less then 10 seconds to finish a subdumain burteforce with the wordlists/subdomains.txt wordlist.

If you have a good connection and think that the tool is slow, try changing the 1000 in the splitDomains function call, e.g. mapM_ (MP.mapM_ (resolve rs)) (splitDomains 1000 allDomains), to a higher value.

Alternatively, you can change mapM_ (MP.mapM_ (resolve rs)) (splitDomains 1000 allDomains) to MP.mapM_ (resolve rs) allDomains to execute all the requests in parallel.