@ResearchDump @kfalconspb @NahamSec Ok, as requested 😊 here's a quick breakdown for the subdomain enumeration #oneliner!
Hard to fit all the fine details in a few tweets, but the quick and dirty version is as follows:
thread below👇
Hard to fit all the fine details in a few tweets, but the quick and dirty version is as follows:
thread below👇
@ResearchDump @kfalconspb @NahamSec 1) First, we use curl to grab text stream output from crt.sh, querying which certificates are registered for <anything>.example.com, and asking crt.sh to give you back the results in json format. Looks messy, eh! 
@ResearchDump @kfalconspb @NahamSec 2) Next we pipe that json format stream in to jq (json data editor), to trim the results down to just the values of the "name_value" pairs, which contain all of the discovered subdomain names. Bit cleaner, but we want more...
@ResearchDump @kfalconspb @NahamSec 3) Pipe those results in turn to sed (text stream editor utility) to remove the containing quotation marks (which as @fharding0 said, could also have been achieved with the -r switch in jq - that would make it a bit shorter & more efficient!)
@ResearchDump @kfalconspb @NahamSec @fharding0 4) Next we pipe the results back in to sed again, this time to remove the leading wildcard subdomain chars (*.)
...Now we're getting somewhere.
...Now we're getting somewhere.
@ResearchDump @kfalconspb @NahamSec @fharding0 5) Finally, we pipe whatever's left in to the sort utility, to put everything neatly in alphabetical order, and use the -u switch to remove duplicates. Voilà! 😋😋😋
