Google Dorks
Online
Wordlist
Subdomain megalist
Exegol
/opt/seclists/Discovery/DNS/fierce-hostlist.txt
/usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
Generate subdomains wordlist
Get only resolved domains with massdns:
Copy $ dnsgen hosts.txt >> dnsgen_wordlist.txt
$ massdns -r ~/tools/massdns/lists/resolvers.txt -o S dnsgen_wordlist.txt | grep -e ' A ' | cut -d 'A' -f 1 | rev | cut -d "." -f1 --complement | rev | sort | uniq > dnsgen_massdns_resolved Using AI
GoBuster
Copy git clone https://github.com/danielmiessler/SecLists
sudo apt install seclists -y Add a DNS Server such as 1.1.1.1 to the /etc/resolv.conf file
Copy gobuster dns -d inlanefreight.com -w /usr/share/SecLists/Discovery/DNS/namelist.txt Pattern found
Example: lert-api-shv-{NUMBER}-sin6.facebook.com
pattern.txt:
Copy lert-api-shv-{GOBUSTER}-sin6
atlas-pp-shv-{GOBUSTER}-sin6
Copy $ export TARGET="facebook.com"
$ export NS="d.ns.facebook.com"
$ export WORDLIST="numbers.txt"
$ gobuster dns -q -r "${NS}" -d "${TARGET}" -w "${WORDLIST}" -p ./patterns.txt -o "gobuster_${TARGET}.txt" Dig
Copy $ for sub in $(cat /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @10.129.14.128 | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done
ns.inlanefreight.htb. 604800 IN A 10.129.34.136
mail1.inlanefreight.htb. 604800 IN A 10.129.18.201
app.inlanefreight.htb. 604800 IN A 10.129.18.15
Copy for sub in $(cat /opt/seclists/Discovery/DNS/fierce-hostlist.txt);do dig $sub.inlanefreight.htb @10.129.104.34 | grep -v ';\|MX' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done DNSenum
Copy dnsenum --dnsserver 10.129.14.128 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb Skanuvaty
Frogy
Subdominator
Amass
Copy amass enum -d target.com Knock
Sublister
Subfinder
Copy ./subfinder -d inlanefreight.com -v
Copy subfinder -d canva.com | shuffledns -d canva;com -r resolvers.txt -mode resolve Assetfinder
Copy assetfinder githubapp.com Subbrute
Copy $ git clone https://github.com/TheRook/subbrute.git >> /dev/null 2>&1
$ cd subbrute
$ echo "ns1.inlanefreight.com" > ./resolvers.txt
$ ./subbrute inlanefreight.com -s ./names.txt -r ./resolvers.txt
Warning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
inlanefreight.com
ns2.inlanefreight.com
www.inlanefreight.com
ms1.inlanefreight.com
support.inlanefreight.com
<SNIP> DNSRecon
PureDNS
Copy puredns -r dnsresolve.txt bruteforce wordlist.txt target.com Dnsx
Takeover
DNS or subdomain Takeover ?
Virtual Host
Ffuf
Copy ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/ Online Hosts
Copy $ httpx -probe -list targets.subdomains -tech-detect -status-code -fr -o targets.httpx
$ cat targets.httpx | grep SUCCESS | grep 200 | awk '{print $1}' > targets.200.httpx Resources
