Bluto is a Python tool designed for DNS enumeration and reconnaissance. It queries for MX and NS records, passively gathers subdomains, and performs brute-force attacks on subdomains using various techniques. The tool also includes email address enumeration using search engines and external services, along with compromised account checking.
Bluto distinguishes itself through its versatile approach to subdomain discovery, employing both passive gathering and targeted brute-forcing with adjustable techniques. It integrates information from multiple sources for comprehensive results. The addition of an HTML report enhances usability compared to previous text-based outputs.
- DNS Zone Transfer: Attempts to retrieve entire DNS zone files for target domains.
- Subdomain Brute-forcing: Uses a large subdomain list and customizable options to discover hidden subdomains.
- Email Enumeration: Leverages search engines, Email Hunter, and HaveIBeenPwned to find email addresses associated with a domain.
Bluto has a history of active development, with frequent releases from 2016 to 2018, indicating ongoing maintenance. Recent updates focus on bug fixes and feature additions. However, it is important to note that the tool currently only supports Python 2.7.x, and is no longer actively maintained.
Security professionals and penetration testers can benefit from Bluto by automating DNS reconnaissance and subdomain enumeration tasks. It helps identify potential attack vectors and uncover valuable information about target organizations. Compared to manual techniques, Bluto provides a scalable and efficient solution for comprehensive domain analysis.