Subdomain enumeration
Methods to discover the subdomain of a root domain.
Last updated
Methods to discover the subdomain of a root domain.
Last updated
Basic command:
Flags
-t: brt - Brute force domains and hosts using a given dictionary
-d : Domain to brute-force
sublist3r enumerates subdomains by utilizing many search engines such as Google, Yahoo, etc. and other services such as Netcraft, VirusTotal, etc.
Basic command:
Flags
-d: Domain to brute-force
Ffuf can be utilized to fuzz the virtual hosts of an IP address. The HTTP Host header can be modified with different values to discover open virtual hosts.
Flags
-w: Path to wordlist
-H: HTTP header to append to request
-u: Target URL
Some web server may return a default status code and content for multiple virtual host addresses. These addresses will return a valid response to ffuf, causing it to be picked up as an active host. This may pollute the results, as these hosts may not actually be a functioning service.
The -fs flag can be used to filter out response sizes (of a fixed and predictable value), to remove the invalid default responses.
