Subdomain enumeration

Tools

Wordlist

Subdomain enumeration

/usr/share/amass/wordlists/subdomains-top1mil-5000.txt
/usr/share/seclists/Discovery/DNS/namelist.txt
/usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Using amass

amass enum --passive -d $url

Using fierce

fierce --domain bcc.gov.bd

Using ffuf

Subdomain Enumeration

ffuf -ic -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://FUZZ.inlanefreight.com

Using dnsenum

Comprehensive DNS enumeration tool that supports dictionary and brute-force attacks for discovering subdomains.

dnsenum --enum inlanefreight.com -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r

Using Google Dorks

site:bcc.gov.bd -domain:www

Using dnsrecon

DNSRecon is a zone enumeration tool that assists users in enumerating DNS records such as A, AAAA, and CNAME. It also performs NSEC zone enumeration to obtain DNS record files of a target domain (to find hidden domains).

dnsrecon -d inlanefreight.com
dnsrecon -d <target domain> -z

Using sublister

Usage

sublist3r -d eccouncil.org -o eccouncil_subdomains.txt 

Sublist3r is a dedicated software tool primarily used by ethical hackers and attackers for subdomain discovery during the Footprinting and Reconnaissance phase of an operation.

Here is a detailed overview of the tool based on the sources:

🔎 Purpose and Functionality

  • Subdomain Enumeration: Sublist3r is explicitly used to gather a list of subdomains associated with a target domain. Finding a company's sub-domains provides insight into different departments and business units in an organization.
  • Passive Intelligence Gathering: The tool performs subdomain discovery by leveraging multiple passive online sources. It searches a wide range of public resources to maximize the chances of finding valid subdomains.
  • Integration with Other Tools: Sublist3r is included as a utility within the BillCipher information gathering tool for performing subdomain listing.

🌐 Sources Used by Sublist3r

When Sublist3r is executed against a target domain, the tool systematically searches several popular services and search engines to enumerate subdomains. These sources include:

  • Baidu
  • Yahoo
  • Google
  • Bing
  • Ask
  • Netcraft
  • DNSdumpster
  • Virustotal
  • ThreatCrowd

⚙️ Command Line Usage

Attackers or ethical hackers use specific commands and parameters to run the Sublist3r tool:

  • Invocation: The primary command to invoke the tool is sublist3r.
  • Target Domain: The parameter -d is used to specify the target domain for which the tool should enumerate subdomains (e.g., -d eccouncil.org).
  • Output File: The parameter -o specifies the output file where the enumerated subdomains will be saved (e.g., -o eccouncil_subdomains.txt).

The full example command shown in the sources is: sublist3r -d eccouncil.org -o eccouncil_subdomains.txt.

🤖 AI Integration

The sources demonstrate that AI-powered tools, such as ChatGPT or other generative AI technology, can be leveraged to automate the use of Sublist3r by generating the appropriate command based on a natural language prompt:

  • Example Prompt: "Use Sublist3r to gather a list of subdomains of the target organization eccouncil".
  • Resulting Command: sublist3r -d eccouncil.org -o eccouncil_subdomains.txt.