Thread by @maikroservice

Day 4⃣6⃣

Let us find some... no ALL the subdomains of our Bug Bounty Target:

Yesterday, we learned how to perform Reconnaissance, if you have not seen the thread - look no further:

https://twitter.com/maikroservice/status/1582864692178866177

and today we define our methodology further - we go the next step:
Subdomain enumeration, as if our lives depend on it!

One more thing.

This might be a very big list in the end...
It is intimidating to see so many possible subdomains and hacking targets.

I am here with you, you just need to start.

Step by step we will get there.

LETZ GO.

From yesterday we have a list of domains

Now we have many possibilities to find subdomains - they can be separated into three categories:

1. manual search
2. automated search
3. Brute force

I would suggest to do it in this order

Why?!

This way you can always stop once you have 1,2,10.. however many you feel comfortable with to hack on!

OK 1. manual search - remember 2 days ago?

google dorking is the most important skill!

you can use this query:
site:target.com -www.target.com

Next you can check the ssl certificates with search engines:

crt.sh/?q=mytarget.com
&
developers.facebook.com/tools/ct/

& also rapid7's DNS dataset (big!)
opendata.rapid7.com/sonar.fdns_v2/

and some more search engines for DNS aggregate data:

dnsdumpster.com
&
searchdns.netcraft.com

one hint: MAKE SURE to check the scope - sometimes the company provides a list of allowed subdomains

hint2: use github search, sometimes there is a list of subdomains already

2. Automated Subdomain enumeration

A lot of tools can be combined, but first we look at what we already have.

HTML + JavaScript.

API calls and other requests often are looking for endpoints on subdomains - juicy targets.

Here are the 4 tools I use when searching for subdomains in source code:

1. github.com/hakluke/hakraw… by @hakluke
2. github.com/jaeles-project…
3. github.com/nsonaniya2010/…
4. github.com/m8sec/subscrap…

Make sure to also use waybackurls (github.com/tomnomnom/wayb…) from @TomNomNom

waybackurls mytarget.com | awk -F"[/:]" '{print $4}' | sort -u | uniq

this will neatly output unique subdomains

OR you use another tool
github.com/tomnomnom/unfu…

which makes this query:

waybackurls mytarget.com | unfurl -u domains

SHORT AND SWEET.

You can also use shodan to find subdomains using: github.com/incogbyte/shos…

OR
github.com/gwen001/github…

(better run this multiple times with delay as @Jhaddix suggests)

Also remember how a while ago I presented some cool technique on how Bug Hunters scrape cloud IP ranges to get more subdomains?

Now is the time to use it.

Here is the thread:

https://twitter.com/maikroservice/status/1578487089465012224

And last but not least the three classics:

subfinder & amass & sublist3r
github.com/OWASP/Amass
github.com/projectdiscove…
github.com/aboul3la/Subli…

They also integrate well with our last section:

3. brute forcing subdomains

One thing to note - brute forcing subdomains is not always a good idea.
You can be blocked and that is a pain in the behind, especially if you hack twitch

Some companies also have rate limits in their programs so make sure to properly read the program details BEFORE going brrrr

We start with amass:

amass enum -brute -d mytarget.com

Next up is shuffleDNS - a wrapper around massDNS github.com/projectdiscove…

shuffledns -d mytarget.com -r resolvers.txt

this needs a resolver.txt which you e.g. can find here: raw.githubusercontent.com/blechschmidt/m…

for the brute force wordlist you can use many many sources, two of my favorites are:

@Jhaddix all.txt - gist.github.com/jhaddix/86a06c…
&
wordlists.assetnote.io

The last thing you can try is permutation scanning - you take all the subdomains you found and mutate them.

e.g. dev.mytarget.com could also be dev-old.mytarget.com or dev01.mytarget.com

this can be achieved by using amass (AGAIN?!!!!)

OR!

github.com/infosec-au/alt…

Now you have a very very very long list of subdomains.

Tomorrow we automagically look at those and see what we can do with them.

If this tweet provided value to you feel free to click the follow button @maikroservice

every day I post a thread about cyber security topics

October - Bug Bounty
November - Blue Team
December - Job Hunting / Career advice

@threadreaderapp unroll