Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of the things I need to do from time to time is to find subdomains of a site for example.

Starting with example.com

  • sub1.example.com
  • other.example.com
  • another.example.com

I'm looking for any additional ways to perform recon on these targets and I want to get a list of all the subdomains of a domain.

I'm currently doing a number of things inlcuding

  • using maltego to crawl for info
  • Using search engines to search for subdomains
  • crawling site links
  • Examining DNS records
  • Examining incorrectly configured SSL certificates
  • Guessing things like 'vpn.example.com'

I reckon there are more than the ones i've found so far, but now I'm out of ideas.

share|improve this question
    
There is another post on stackoverflow that's quite good: [List of Subdomains][1] [1]: stackoverflow.com/questions/131989/… –  Dr.Ü Apr 30 '13 at 6:58
    
Unfortunately It didn't work out. The wolfram alpha tool was promising, but didn't work any more sadly. AXFR requests aren't allowed either which seems to be what most of the other subbies are.. –  NULLZ Apr 30 '13 at 7:06
2  
I would try it with knock (code.google.com/p/knock) but watch out: there is a risk of being blacklisted. –  Dr.Ü Apr 30 '13 at 7:19
1  
There's a python script called subdomainer.py that should be able to help you out... Have a search on google –  AndyMac Apr 30 '13 at 7:38
1  
FYI it can be found on the edge-security.com website, but the old link posted on SecurityTube wiki page is dead (albeit it does have usage example which is of course defined in usage() anyway). Judging by source code, what it does is it collates data from three major search engines (yahoo, msn, google) and to me obscure website pgp.rediris.es that seems to be an email scrapper. –  TildalWave Apr 30 '13 at 7:57

3 Answers 3

up vote 3 down vote accepted

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. This subdomain list is more than 16 times the size of fierce2 and subbrute will take about 15 minutes to exhaust this list on a home connection. The output is a clean newline separated list, that is easy to use as the input for other tools like nmap or a web application vulnerability scanner.

share|improve this answer
    
Awesome, i'll check it out. Any idea how well it compares to 'knock'? –  NULLZ May 5 '13 at 6:00
    
@D3C4FF idk i haven't used knock, i'll have to check that out. I expect that the subdomain brute force feature is better than knock. –  Rook May 5 '13 at 15:22
1  
@D3C4FF knock is crap. –  Rook May 5 '13 at 19:32
    
@Rook but knock have the ability to try domaintransfers (even you need some luck to get one) –  Dr.Ü May 6 '13 at 7:37
    
@Dr.Ü yes I will add that simple feature. But as you said, it doesn't work all of the time. As a note subbrute has more code, and is more complex without the addition of domain transfers. –  Rook May 6 '13 at 23:16

I would try it with knock (code.google.com/p/knock) but watch out: there is a risk of being blacklisted.

Unfortunately is there no way around bruteforcing if a zone transfer doesn't work.

share|improve this answer
1  
This tool is low quality; SubBrute is a lot better. –  Rook May 5 '13 at 19:32
    
Thanks, i'll give it a try... –  Dr.Ü May 6 '13 at 7:26

Take a look at http://ha.ckers.org/fierce/. It can take a dictionary file as well as brute force. It is included in Kali as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.