Subdomains

Discovering Subdomains - Passive

The passive discovery of a target’s subdomains relies on publicly available information. An excellent source of data for discovering subdomains is SSL certificates. I detail some good methods to obtain SSL certificate data here.

Google Dorking is a great method for discovering subdomains for a target. You can use the site: operator to filter results for the given domain in Google search.

1
site:*.hacker.com    # Using the site: operator to Google search all indexed subdomains for the target domain

crt.sh can be used to extract subdomains for a target. It aggregates data from Certificate Transparency (CT) logs, which are publicly accessible records of SSL/TLS certificates issued by certificate authorities (CAs).

1
curl -k -s "https://crt.sh/?q=pentesting.site&output=json" | jq -r '.[] | "\(.name_value)\n\(.common_name)"' | sort -u    # Extracts subdomains for a target domain

subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It is an excellent tool from ProjectDiscovery and can be found here: https://github.com/projectdiscovery/subfinder. There are several services that require API keys and are worth setting up.

1
subfinder -silent -all -d hacker.com    # Use all sources for enumeration of subdomains

Sublist3r is a Python tool designed to enumerate subdomains of websites using OSINT. It can be found here: https://github.com/aboul3la/Sublist3r.

1
python3 ./sublist3r.py -d hacker.com    # Search for subdomains using Google, Yahoo, Bing, Baidu and Ask etc.

Knockpy is a portable and modular Python3 tool designed to enumerate subdomains on a target domain through passive reconnaissance. It can be downloaded here: https://github.com/guelfoweb/knock.

1
knockpy -d hacker.com --recon           # Perform subdomain reconnaissance on the target domain

Discovering Subdomains - Active

Active subdomain discovery for a target involves actively probing a target domain’s infrastructure to identify subdomains. Your first direct interaction should always be to attempt a Zone Transfer on a target’s DNS server (if they have one). If a Zone Transfer is successful, there’s no need to continue the subdomain enumeration process as a successful zone transfer would result in having ALL domain information for the target.

The following are two methods of DNS Zone Transfer using nslookup and dig.

1
nslookup -type=NS hacker.com                                  # Identify the name server(s) of the target domain
2
nslookup -type=any -query=AXFR hacker.com nameserver.net      # Perform an Authoritative Transfer for the target domain and nameserver
3

4
dig @nameserver.net hacker.com AXFR                           # Attempt a zone transfer using dig

If a DNS zone transfer is unsuccessful the next most effective active subdomain discovery activity is Subdomain Brute Forcing. This involves tools and techniques that use all possible combinations of words, alphabets, and numbers before the main domain to get a subdomain that resolves to an IP address.

Many tools can be used, starting with a basic bash script and the Linux built-in host application. The following takes a list of possible subdomains, appends it to the root domain and attempts to resolve it. If it resolves to an IP address you have discovered a valid subdomain.

1
#!/bin/bash
2

3
if [ "$1" == "" ]; then
4
    echo "Usage: ./subdomains.sh [domain]"
5
    echo "Example: ./subdomains.sh mydomain.com"
6
else
7
    for domain in $(cat subdomains.txt); do
8
        host $domain.$1 | grep "has address\|is an alias for"
9
    done
10
fi

Some good lists for subdomain brute forcing tools:

• Assetnote Wordlists
• jhaddix All
• SecLists
• danTaler
• fuzzdb

The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open-source information gathering and active reconnaissance techniques. It can be used for brute forcing subdomains.

1
amass enum -brute -w all.txt -d hacker.com              # Perform brute force subdomain enumeration of the target domain
2
amass enum -brute -alts -w all.txt -d hacker.com        # Perform brute force subdomain enumeration with generation of altered names enabled

gobuster is also a great tool to brute force subdomains. You can find the tool here: https://github.com/OJ/gobuster.

1
gobuster dns -t 30 -w all.txt -d hacker.com       # DNS subdomain enumeration mode to brute force target domain
2
gobuster dns -t 30 -w all.txt -d hacker.com -i    # DNS subdomain enumeration mode and output IP addresses of subdomains

shuffledns from ProjectDiscovery supports subdomain brute forcing of a target with a given wordlist. It requires massdns to be installed. shuffledns is available to download here: https://github.com/projectdiscovery/shuffledns.

1
shuffledns -d hacker.com -w all.txt -r resolvers.txt -mode bruteforce    # Subdomain brute force of a target domain. The resolvers.txt must contain DNS resolvers such as 8.8.8.8 and 1.1.1.1

The HTTP Content Security Policy (CSP) response header is a header that tells the browser from what sources it is allowed to include and execute resources. There are often useful subdomains added to the CSP response header. The following is a short Python3 script that you can use and build on to extract the CSP header of a target domain.

1
import re
2
import requests
3
from urllib.parse import urlparse
4

5
def extract_domains(csp_header):
6
    domains = set()
7
    directives = csp_header.split(';')
8
    for directive in directives:
9
        parts = directive.split()
10
        if len(parts) > 1:
11
            for part in parts[1:]:
12
                if part.startswith(('http://', 'https://')):
13
                    domain = urlparse(part).netloc
14
                    domains.add(domain)
15
                else:
16
                    domains.add(part)
17
    return domains
18

19
def get_csp_header(domain):
20
    headers = {
21
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36'
22
    }
23
    try:
24
        response = requests.get(f'https://{domain}', headers=headers)
25
        csp_header = response.headers.get('Content-Security-Policy', '')
26
        return csp_header
27
    except requests.exceptions.RequestException as e:
28
        print(f"An error occurred: {e}")
29
        return ''
30

31
# Get user input for the domain
32
domain = input("Enter domain: <tesla.com> ")
33

34
# Fetch the CSP header for the given domain
35
csp_header = get_csp_header(domain)
36

37
# Extract domains from the CSP header
38
if csp_header:
39
    domains = extract_domains(csp_header)
40
    print(f"Domains extracted from CSP header for {domain}:")
41
    for d in domains:
42
        print(d)
43
else:
44
    print(f"No CSP header found for {domain}")

The script output will look like the below.