How to Quickly Look Up the Valid Subdomains for Any Website « Null Byte :: WonderHowTo

Traditionalsubdomain enumerationtechniques create a lot of noise on the target server and may alert intrusion detection systems to an attacker's intentions. For a stealthier approach, there's a tool with the capability of finding hundreds of subdomains related to the target website without alarming the server administrators.What Are Subdomains?Subdomains, sometimes referred to as "third-level" domains, have many different purposes. They're often used to createnichewebsites for a specific subset of users. For example, Null Byte (null-byte.wonderhowto.com) is one of many subdomains in the WonderHowTo network of websites.Subdomains are also commonly used to create separate mobile websites, such asm.facebook.com andmobile.twitter.com. Other examples of subdomains includeshop.protonmail.com,support.hackerone.com, anddeveloper.github.com.Why Subdomains Are Important to HackersThese subdomains are interesting because while the subdomain and main domain share the main domain name, the two websites may actually reside on completely different servers, in different parts of the world, and may not exercise the same server-side security measures.This exposes the website administrator(s) to a variety of attacks such as subdomain takeover attacks, like those that affectedDonald Trump's fundraising website(which was defaced) andUber's website(where a white hat was able to get at least $5,000 for reporting the bug) in 2017. There have also been incidents ofbanks falling victimto subdomain related attacks.Don't Miss:How to Scrape Target Email Addresses with TheHarvesterWhat Is Sublist3r?Sublist3r, created byAhmed Aboul-Ela, is a Python tool designed to find website subdomains usingpublicly available sourcessuch as search engines and databases likeNetcraft,VirusTotal,ThreatCrowd,DNSdumpster,Google,Bing,Baidu, and more. Sublist3r is a powerful tool capable of locating hundreds of subdomains belonging to a single target website without creating a noticeable attack fingerprint.Step 1: Install Sublist3rAn older version of Sublist3r can be found in theKalirepositories. To avoid potential confusion, any version of Sublist3r which may already be installed should be removed using the below command.apt-getautoremove sublist3rNext, clone theSublist3r GitHub repository. This will ensure the latest version is downloaded and all of Sublist3r's newest features and engines are available.git clone https://github.com/aboul3la/Sublist3rStep 2: Install Sublist3r's DependenciesThen,cdinto the "Sublist3r" directory and usepip, a tool for installing and managing Python packages, to install the Sublist3r dependencies. This command is required to run Sublist3r. The-rargument instructs pip to install the dependencies found in the "requirements.txt" file.cd Sublist3r/pip install -r requirements.txtStep 3: Verify It's WorkingThe--help(or-h) argument can be used to verify Sublist3r is working properly and view the available options. As you'll see, each option has a long and short form argument available../sublist3r.py --helpThat's it for cloning Sublist3r and installing dependencies — there are no modifications or configurations required.Step 4: Find Subdomains with Sublist3rTo start enumerating subdomains, use the below command../sublist3r.py --domain target_website.com --ports 80,443 --verbose --threads 50 --output /path/to/filename.txtThe--domain(or-d) argument defines the target website. This is the target website which Sublist3r will attempt to find subdomains for.Ports80and443(defined using--portsor-p) are theofficialTCP ports reserved for websites. Sublist3r can attempt to enumerate subdomains on additional ports, but as these are the most common ports used by websites on the entire internet, it's safe to restrict the command to just these ports.Sublist3r can print additional information related to discovered subdomains as the command is running. This is an optional setting and enabled using the--verbose(or-v) argument.Websites (e.g., Google) may blacklist or rate-limit requests originating from a users IP address, which would cause Sublist3r to produce fewer results. By default, Sublist3r locates subdomains within seconds. Modifying the--thread(or-t) count is another optional argument, but some readers may wish to increase (or decrease) the speed of the enumeration.Where the list of discovered subdomains are saved to is defined by the--output(or-o) argument. If this argument is not included in the command, Sublist3r will simply print the subdomains in the terminal.For example, I chose the following for my query, and as seen in the image below, Sublist3r will use every search engine and database at its disposal, then print the results it finds to the .txt file we indicated. If there is no path indicated before the filename you select, the file will be created and saved in the current directory../sublist3r.py --domain target_website.com --ports 80,443 --verbose --threads 50 --output filename.txtIf only one or two search engines are desired, the--engines(or-e) argument can be used. The engines should be separated by a single comma (,) as shown in the below command../sublist3r.py -d target_website.com --enginesengine,engine,engine-p 80,443Below is an example command where I enumerated WonderHowTo subdomains using only the DNSdumpster and Yahoo engines and omitted the--outputargument../sublist3r.py -d wonderhowto.com --engines dnsdumpster,yahoo -p 80,443That's it for downloading and using Sublist3r to enumerate subdomains via open-source intelligence gathering. Leave questions and comments below or message me on Twitter@tokyoneon_if you have any further thoughts.Don't Miss:How to Clone Any Website Using HTTrackFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image bySoumil Kumar/PEXELSand Screenshots by tokyoneon/Null ByteRelatedHow To:Force Safari to Automatically Show Reader View for Specific Websites on Your iPhoneAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Uncover Hidden Subdomains to Reveal Internal Services with CT-ExposerHack Like a Pro:Abusing DNS for ReconnaissanceHow To:Find Identifying Information from a Phone Number Using OSINT ToolsHow To:Bypass Facebook's HSTSHow To:Block Annoying GDPR Cookie Pop-Ups While Browsing the Web on AndroidHow To:Use Photon Scanner to Scrape Web OSINT DataHow To:Sew DIY pom pom knee high sock hold upsHow To:Do speed end of bench tricep push ups drop setHow To:Track a Package with UPSHow To:Ship Internationally with UPSHow To:Conduct OSINT Recon on a Target Domain with Raccoon ScannerHow To:Improve Cash Flow with the UPS Billing CenterHow To:Practice fast Gravitron neutral grip pull upsHow To:Calculate Shipping Costs with UPSHow To:Allow pop-up windows on a specific websiteAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:Fully Utilize Your Pull-Up Bar.How To:Level up 10 levels in >10 min in Final Fantasy TacticsHow To:Ship a Package with UPSHow To:Make your UPS battery last a long timeHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityNews:SOPA and PIPA Blackout!News:See Kai Run Holiday Coupon, valid until 12/31/10News:WATCH THIS INSTEAD - Grown UpsNews:Grown UpsNews:Free cake alert! Valid Nov 16 only from Coldstone!News:The Kick Ass Video Game!How To:Be a Navy SEALHow To:How Credit Card Algorithms Work: The Anatomy of Credit Card NumbersNews:Vamos ComeçarHow To:Burn an XDG3 Formatted Xbox 360 Game ISO with LinuxNews:How-To-Generate Thousands Of Valid Email IDsHow To:Burn an XDG3 Formatted Xbox 360 Game ISO with WindowsHow To:Flash BenQ Xbox 360 Drives to Play XDG3 Back-upsHow To:Get Google Music in Canada Without a VPNUncrackable:Secure Your Secrets with 4096-Bit EncryptionNews:LA County health enforcers conduct door-to-door raw milk confiscation operatioButler:The Ultimate Time Saving App for Mac