Thread by @HackerGautam

Subdomain Enumeration 101 🏆 👇

1. Passive Enumeration
2. Active Enumeration

@shifacyclewala @Hacktifycs
#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Passive:
1. Google Dorking:
“site:*.example.org -www -store -jobs -uk”
2. virustotal
3. dnsdumpster
4. crt[.]sh
5. censys[.]io
6. Rapid7 Sonar Datasets
7. Dnsbufferover

#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Unique Ways:
1. dig +multi AXFR @ns1.dns.co insecuredns.com
2. CSP (curl -I -s -L https://some[.]com | grep -iE 'Content-Security|CSP')
3. Github Subdomains
4. nmap --script targets-asn --script-args targets-asn.asn=17012
5. Scraping using webscrapers
#bugbountytips

Tools :
1. amass
2. subfinder
3. sublist3r
4. findomain
5. dnsrecon
6. gobuster
7. knock
8. massdns
#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Virtual Hosts Discovery:
1. vhost-brute
2. Virtual-host-discovery

#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Public datasets:

1. Scans[.]io
2. Riddler
3. SecurityTrails
4. Common Crawl
4. PassiveTotal
5. DNSDB
6. Forward DNS dataset
7. WhoisXML API
8. whoxy (reverse whois)
9. whoisxmlapi[.]com (reverse whois)
10. wayback
12. alienvault OTX
#bugbountytips #bugbounty #infosec #cyber

Search Engines:
1. ZoomEye
2. FOFA
3. Shodan
4. ThreatCrowd
5. Censys
6. greynoise

#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Active Subdomain Enumeration:
Subdomain discovery through alterations and permutations
1. altdns
2. purends
3. shuffledns

#bugbountytips #bugbounty #infosec #cybersecurity #hacking

Subdomain Enum Wordlists:
1. all.txt
2. commonspeak
3. seclists
4. shubs
5. assetnote wordlists

#bugbountytips #bugbounty #infosec #cybersecurity #hacking