Difference between revisions of "Finding subdomains"
Jump to navigation
Jump to search
(using Archive.Today) |
m (Added Cloudflare note to SecurityTrail and added grammatical `:`s for consistency where appropriate.) |
||
| Line 2: | Line 2: | ||
# The methods listed on [[Site exploration]] | # The methods listed on [[Site exploration]] | ||
# Use SecurityTrail https://securitytrails.com/ | # Use SecurityTrail: https://securitytrails.com/ Behind Cloudflare DDoS protection as of 2024-07-07. | ||
# Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | # Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | ||
# Use Subdomain Center: https://www.subdomain.center/ | # Use Subdomain Center: https://www.subdomain.center/ | ||
| Line 9: | Line 9: | ||
# Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html | # Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html | ||
# https://osint.sh/subdomain/ | # https://osint.sh/subdomain/ | ||
# Certificate transparency logs https://crt.sh/ | # Certificate transparency logs: https://crt.sh/ | ||
# Software options: | # Software options: | ||
## Subfinder, which includes several of the above methods https://github.com/projectdiscovery/subfinder | ## Subfinder, which includes several of the above methods: https://github.com/projectdiscovery/subfinder | ||
## assetfinder https://github.com/tomnomnom/assetfinder | ## assetfinder: https://github.com/tomnomnom/assetfinder | ||
## Knockpy https://github.com/guelfoweb/knock | ## Knockpy: https://github.com/guelfoweb/knock | ||
## dnsenum2 https://github.com/SparrowOchon/dnsenum2 | ## dnsenum2: https://github.com/SparrowOchon/dnsenum2 | ||
## dnsmap https://github.com/resurrecting-open-source-projects/dnsmap | ## dnsmap: https://github.com/resurrecting-open-source-projects/dnsmap | ||
## gobuster https://github.com/OJ/gobuster | ## gobuster: https://github.com/OJ/gobuster | ||
## Sublist3r https://github.com/aboul3la/Sublist3r | ## Sublist3r: https://github.com/aboul3la/Sublist3r | ||
## Altdns https://github.com/infosec-au/altdns | ## Altdns: https://github.com/infosec-au/altdns | ||
# Twitter search | # Twitter search | ||
# Archive.Today, with asterisk: https://archive.today/*.example.org | # Archive.Today, with asterisk: https://archive.today/*.example.org | ||
# Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6 | # Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6 | ||
Revision as of 20:05, 7 July 2024
There are several ways to attempt to find subdomains for a given domain.
- The methods listed on Site exploration
- Use SecurityTrail: https://securitytrails.com/ Behind Cloudflare DDoS protection as of 2024-07-07.
- Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available.
- Use Subdomain Center: https://www.subdomain.center/
- Use DNSdumpster: https://dnsdumpster.com/
- Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list
- Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html
- https://osint.sh/subdomain/
- Certificate transparency logs: https://crt.sh/
- Software options:
- Subfinder, which includes several of the above methods: https://github.com/projectdiscovery/subfinder
- assetfinder: https://github.com/tomnomnom/assetfinder
- Knockpy: https://github.com/guelfoweb/knock
- dnsenum2: https://github.com/SparrowOchon/dnsenum2
- dnsmap: https://github.com/resurrecting-open-source-projects/dnsmap
- gobuster: https://github.com/OJ/gobuster
- Sublist3r: https://github.com/aboul3la/Sublist3r
- Altdns: https://github.com/infosec-au/altdns
- Twitter search
- Archive.Today, with asterisk: https://archive.today/*.example.org
- Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6