What is Subdomain Enumeration?
Domains represent the organization’s main assets which run mostly on main web applications (i.e for customers) but multiple web applications run under one domain which would be difficult to remember and these issues will bother customers as well because they would see unwanted details.
Subdomains are created under domains which could be used to host different web applications and other resources under the same domain.
Enumerating subdomains which hosts web applications, prod instances, cloud assets, storage helps pentester to map attack surface and segregate assets accordingly.
Why Subdomain Enumeration?
The more subdomains increases more chances for finding vulnerabilities during any security assessment. Subdomain enumeration helps in finding internal applications used by internal resources to uncover untouch vulnerabilities.
Subdomain Enumeration Techniques
1.Google Dorks
Google Dorks helps in uncovering and discovering indexed subdomains and endpoints on google search results. Sometimes these results give very exciting data such as Credentials indexed on google search results.
We can use the “site:” operator as part of google dorks to look for subdomains under a particular domain.
We can exclude unwanted subdomains or subdomains which we already have noted and narrow down search results to remove duplicates. For Example ‘site:”*.verisign.com” -www -blog -advocacy’. Using this way, it is possible to enumerate more indexed subdomains on google.
2. Third-Party DNS Datasets
Some third-party vendors have massive DNS sets which could be utilized to find subdomains by using those DNS resolutions to increase attack surface.
1.VirusTotal
Virus Total utilizes its own DNS resolution from it’s DNS dataset in a passive way
2.ThreatCrowd (Powered by AlienVault)
ThreatCrowd is powered by AlienVault and is effective to look for more subdomains.
3.Certificate Transparency
SSL/TLS certificates contain domain names and subdomains which helps in finding subdomains based on certificates in CA’s public repository.
We can use for enumerating subdomains:
- Crt.sh
- Meta CT Search
1.Crt.sh
Crt.Sh is one of the most reliable tools as per my observation for finding subdomains based on certificates. You can visit this on https://crt.sh/
2.Meta CT Search
Meta has its own Certificate Transparency Monitoring Search Engine which can provide subdomains. You can visit this at https://developers.facebook.com/tools/ct/search/
4. Subdomain Brute Forcing
Amass is an open-source tool for subdomain enumeration which can find subdomains from various sources if the API for each source is given in the configuration file.
Amass can be used to bruteforce subdomains as well using this command “amass enum -brute -w subdomains.txt -d example.com -o results.txt”.
5. Subdomain Enumeration (Multiple Sources)
Tools like Amass and Subfinder use multiple sources to find subdomains such as shodan,censys,virus total, and alien vault.
Configuring with respective APIs can automate this process for finding vulnerabilities.
1.Subfinder
Subfinder can be used with command “subfinder -d verisign.com” to enumerate subdomains from multiple sources.
2.Amass
Amass is an alternative for Subfinder for subdomain discovery and is similar to subfinder which uses multiple sources to find subdomains to increase or map attack surface.
6. Permutation-Based Subdomain Discovery
1.Alterx
With the help of Alterx, we can create different permutations for subdomains and then bruteforce those permutations against the target domain to uncover hidden subdomains.
2.dnsX
DnsX is an open-source for running probes over permuted assets to identify live and accessible assets and resolves DNS as well.