> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/recon/dns-subdomain-enumeration.md).

# DNS Subdomain Enumeration

## Google Dorks

{% content-ref url="/pages/yJvJ17kdWiGpCtDCxAZF" %}
[Google Dorks](/0xss0rz/pentest/recon/google-dorks.md)
{% endcontent-ref %}

## Online

{% embed url="<https://recox.hackerz.space/>" %}

{% embed url="<https://subdomainfinder.c99.nl/>" %}

{% embed url="<https://pentest-tools.com/information-gathering/find-subdomains-of-domain>" %}

{% embed url="<https://dnsdumpster.com/>" %}

## Wordlist&#x20;

### Subdomain megalist

{% embed url="<https://github.com/netsecurity-as/subfuz/blob/master/subdomain_megalist.txt>" %}

### Exegol

* `/opt/seclists/Discovery/DNS/fierce-hostlist.txt`
* `/usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt`

## Generate subdomains wordlist

{% embed url="<https://github.com/AlephNullSK/dnsgen>" %}

Get only resolved domains with massdns:

```
$ dnsgen hosts.txt >> dnsgen_wordlist.txt
$ massdns -r ~/tools/massdns/lists/resolvers.txt -o S dnsgen_wordlist.txt | grep -e ' A ' | cut -d 'A' -f 1 | rev | cut -d "." -f1 --complement | rev | sort | uniq  > dnsgen_massdns_resolved
```

{% embed url="<https://github.com/trickest/mksub?tab=readme-ov-file>" %}

Using AI

{% embed url="<https://github.com/jthack/cewlai>" %}

## GoBuster

```
git clone https://github.com/danielmiessler/SecLists
sudo apt install seclists -y
```

Add a DNS Server such as 1.1.1.1 to the `/etc/resolv.conf` file

```
gobuster dns -d inlanefreight.com -w /usr/share/SecLists/Discovery/DNS/namelist.txt
```

### **Pattern found**

Example: `lert-api-shv-{NUMBER}-sin6.facebook.com`

pattern.txt:

```shell-session
lert-api-shv-{GOBUSTER}-sin6
atlas-pp-shv-{GOBUSTER}-sin6
```

```shell-session
$ export TARGET="facebook.com"
$ export NS="d.ns.facebook.com"
$ export WORDLIST="numbers.txt"
$ gobuster dns -q -r "${NS}" -d "${TARGET}" -w "${WORDLIST}" -p ./patterns.txt -o "gobuster_${TARGET}.txt"
```

## Dig

```shell-session
$ for sub in $(cat /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @10.129.14.128 | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done

ns.inlanefreight.htb.   604800  IN      A       10.129.34.136
mail1.inlanefreight.htb. 604800 IN      A       10.129.18.201
app.inlanefreight.htb.  604800  IN      A       10.129.18.15
```

```
for sub in $(cat /opt/seclists/Discovery/DNS/fierce-hostlist.txt);do dig $sub.inlanefreight.htb @10.129.104.34 | grep -v ';\|MX' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done
```

## DNSenum

```shell-session
dnsenum --dnsserver 10.129.14.128 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb
```

## Skanuvaty

{% embed url="<https://github.com/Esc4iCEscEsc/skanuvaty>" %}

## Other tools

### Frogy

{% embed url="<https://github.com/iamthefrogy/frogy>" %}

### Subdominator

{% embed url="<https://github.com/RevoltSecurities/Subdominator>" %}

### Amass

```
amass enum -d target.com
```

{% embed url="<https://blog.intigriti.com/hacking-tools/hacker-tools-amass-hunting-for-subdomains>" %}

### Knock

{% embed url="<https://github.com/guelfoweb/knock>" %}

### Sublister

{% embed url="<https://github.com/aboul3la/Sublist3r>" %}

### Subfinder

{% embed url="<https://github.com/projectdiscovery/subfinder>" %}

```shell-session
./subfinder -d inlanefreight.com -v   
```

```
subfinder -d canva.com | shuffledns -d canva;com -r resolvers.txt -mode resolve
```

### Assetfinder

{% embed url="<https://github.com/tomnomnom/assetfinder>" %}

```
assetfinder githubapp.com
```

### Subbrute

```shell-session
$ git clone https://github.com/TheRook/subbrute.git >> /dev/null 2>&1
$ cd subbrute
$ echo "ns1.inlanefreight.com" > ./resolvers.txt
$ ./subbrute inlanefreight.com -s ./names.txt -r ./resolvers.txt

Warning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
inlanefreight.com
ns2.inlanefreight.com
www.inlanefreight.com
ms1.inlanefreight.com
support.inlanefreight.com

<SNIP>
```

### DNSRecon

{% embed url="<https://github.com/darkoperator/dnsrecon>" %}

{% embed url="<https://www.hackercoolmagazine.com/complete-guide-to-dnsrecon/>" %}

### PureDNS

{% embed url="<https://github.com/d3mondev/puredns>" %}

```
puredns -r dnsresolve.txt bruteforce wordlist.txt target.com
```

### Dnsx

{% embed url="<https://github.com/projectdiscovery/dnsx>" %}

## Takeover

{% hint style="success" %}
DNS or subdomain Takeover ?&#x20;
{% endhint %}

{% content-ref url="/pages/ZAb8rsXaiN0YOqEZMyCb" %}
[DNS (53)](/0xss0rz/pentest/protocols/dns-53.md)
{% endcontent-ref %}

## Virtual Host

{% content-ref url="/pages/ll4ySN9pOr2xc7Gdun0S" %}
[Virtual Host](/0xss0rz/pentest/recon/virtual-host.md)
{% endcontent-ref %}

## Ffuf

```shell-session
ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/
```

## Online Hosts

```
$ httpx -probe -list targets.subdomains -tech-detect -status-code -fr -o targets.httpx
$ cat targets.httpx | grep SUCCESS | grep 200 | awk '{print $1}' > targets.200.httpx
```

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>

## Resources

{% embed url="<https://www.yeswehack.com/learn-bug-bounty/subdomain-enumeration-expand-attack-surface?utm_campaign=blog-subdomain-enumeration&utm_medium=social&utm_source=linkedin>" %}

{% embed url="<https://www.thehacker.recipes/web/recon/domains-enumeration>" %}

{% embed url="<https://blog.projectdiscovery.io/recon-series-2/>" %}