otlite · Domain and DNS

Install Fierce on Linux or macOS in one command

Fierce brute-forces subdomains with a wordlist, tries zone transfers, and scans the IP space around the hosts it finds for more names. It is an old-school DNS recon tool that still works.

Fierce in three lines

pipx install otlite
otlite install fierce
otlite run fierce -- d:example.com

Runs mschwager/fierce (GPL-3.0, ★ 1.8k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What Fierce is for

Finding non-contiguous IP ranges tied to a domain.
Zone transfer checks on your own name servers.

Typed inputs for Fierce

otlite translates these prefixes into Fierce's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: Domain · otlite run fierce -- d:example.com

Run every installed tool that takes the same input at once: otlite run --all d:example.com

Where the results go

Every run lands under ./results/fierce/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff fierce <target>, and pull indicators out with otlite extract fierce.

Before you run it

Brute force and zone transfer attempts are visible to the target's DNS operators.

Update, remove, inspect

otlite info fierce      # inputs, keys, an example command
otlite example fierce   # sample output, where there is one
otlite update fierce    # move to the next tested version
otlite remove fierce    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

ctfr

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh.

dnsgen

dnsgen takes a list of known subdomains and generates plausible permutations: numbers, environments, regions, and common words.

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

FAQ

Fierce with otlite, answered

How do I install Fierce on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install fierce. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does Fierce take through otlite?

d: (domain). otlite maps each prefix to Fierce's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otlite save Fierce results?

Under ./results/fierce/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff fierce <target> to compare the last two.

Does Fierce need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.

Can I run Fierce together with other tools?

Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including Fierce. Save the combination as a playbook to repeat it.