#8 Subdomain Enumeration —How to find Subdomains of any Domain (2024)

#8 Subdomain Enumeration —How to find Subdomains of any Domain (2)

Hello, I have come today with a very useful topic of recon. In this blog we will see how to find Subdomain of any target. So, lets start.

A subdomain is, as the name would suggest, an additional section of your main Domain name. You create subdomains to help organize and navigate to different sections of your main website. Within your main Domain, you can have as many subdomains as necessary to get to all of the different pages of your website.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (3)

It is one of the most crucial parts of the reconnaissance phase while performing a security assessment. Subdomain Enumeration is a process of finding sub-domains of one or more root domains.

Why we need Subdomain Enumeration?

Subdomain Enumeration helps to create a scope of security assessment by revealing Domains/Subdomains of a target organization. It increases the chance of finding vulnerabilities. And it helps us in finding the web applications that might be forgotten/left unattended by the organization for the maintenance or other reasons and may lead to the disclosure of critical vulnerabilities.

By search engines

Search engines like Google supports various advanced search operators to refine search queries. These operators are often referred to as Google Dorks. We can use site: operator in Google search to find all the Subdomains that Google has found for a Domain. Lets take an example on “site:vulnweb.com”.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (4)

By online sites

These are some online sites who find the Subdomains of any Domain.

  1. https://scantrics.io/subdomain-scanner/
  2. https://site-analyzer.pro/services-seo/site-all-subdomains/
  3. https://wikihak.com/Subdomains/Subdomains-scanner.php
  4. https://subdomainfinder.c99.nl/

Lets take an example

#8 Subdomain Enumeration —How to find Subdomains of any Domain (5)

By Subfinder(in Kali machine)

Subfinder is a Subdomain discovery tool that discovers valid Subdomains for websites by using passive online sources. It has a simple modular architecture and is optimized for speed.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (6)

Installation Subfinder:- Open Kali Terminal

sudo git clone https://github.com/projectdiscovery/subfinder.git

And will be installed. Now open new terminal and type this command

subfinder -d "your target domain"

I am taking “example.com”.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (7)

By Sublist3r(in Kali machine)

Sublister is a tool designed in python and uses OSINT in order to enumerate Subdomains of websites. It helps pen-testers in collecting and gathering Subdomains for a Domain which is their target.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (8)

For installation of Sublist3r checkout this link https://www.geeksforgeeks.org/what-is-sublist3r-and-how-to-use-it/

And will be installed. Now open new terminal and type this command

sublist3r -d "your target domain"

I am taking “vulnweb.com”.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (9)

By Amass(in Kali machine)

This package contains a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (10)

Installation Amass:- Open Kali Terminal and write these commands

sudo apt-get update
sudo apt-get install amass

And will be installed. Write the Subdomain Enumeration command.

amass enum -d "your target domain"

I am again taking “vulnweb.com”.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (11)

Brute Force Subdomain By ffuf(in Kali machine)

ffuf is a fest web fuzzer written in Go that allows typical directory discovery, virtual host discovery (without DNS records) and GET and POST parameter fuzzing.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (12)

Installation ffuf:- Open Kali Terminal and write this

git clone https://github.com/ffuf/ffuf ; cd ffuf ; go get ; go build

And will be installed. In this method we are performing brute force, so we also need domain wordlist. You can download the Subdomain wordlist by Google and save wordlists folder. Now see an example on “vulnweb.com”

Command,

ffuf -w /path/to/wordlist -u https://FUZZ.target

-w means wordlist, -u means target URL and FUZZ is the part that has to be brute force.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (13)

Here are some methods to find subdomain, hope you will have learned something new that’s all for today. Thank you for reading. Be an #Ethical Hacker and stay safe.

P.S. I am looking for a job, my email is uttamgupta1802@gmail.com.

#8 Subdomain Enumeration —How to find Subdomains of any Domain (2024)

References

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Dong Thiel

Last Updated:

Views: 5896

Rating: 4.9 / 5 (79 voted)

Reviews: 86% of readers found this page helpful

Author information

Name: Dong Thiel

Birthday: 2001-07-14

Address: 2865 Kasha Unions, West Corrinne, AK 05708-1071

Phone: +3512198379449

Job: Design Planner

Hobby: Graffiti, Foreign language learning, Gambling, Metalworking, Rowing, Sculling, Sewing

Introduction: My name is Dong Thiel, I am a brainy, happy, tasty, lively, splendid, talented, cooperative person who loves writing and wants to share my knowledge and understanding with you.