Difference between revisions of "Finding subdomains"
Jump to navigation
Jump to search
(Get rid of stuff redundant with Discovery) |
(reference the Discovery and Site exploration pages, otherwise the removed methods will be lost to users of this page) |
||
| Line 1: | Line 1: | ||
There are several ways to attempt to find subdomains for a given domain | There are several ways to attempt to find subdomains for a given domain. | ||
# The methods listed on [[Discovery]] and [[Site exploration]] | |||
# Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | # Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | ||
# Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list | # Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list | ||
Revision as of 13:32, 2 August 2023
There are several ways to attempt to find subdomains for a given domain.
- The methods listed on Discovery and Site exploration
- Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available.
- Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list
- Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html
- https://osint.sh/subdomain/
- Certificate transparency logs https://crt.sh/
- Software options:
- Subfinder, which includes several of the above methods https://github.com/projectdiscovery/subfinder
- Knockpy https://github.com/guelfoweb/knock
- dnsenum2 https://github.com/SparrowOchon/dnsenum2
- dnsmap https://github.com/resurrecting-open-source-projects/dnsmap
- gobuster https://github.com/OJ/gobuster
- Twitter search
- Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6