Sub-domain Enumeration
Google Dorking
Google dorks can be used to enumerate host subdomains. For example searching for Microsoft.com subdomains we can use the minus - symbol to tell Google to remove URL results for particular strings.
Every time a sub domain is found it can then be excluded from the next search
Tools
Amass
DNSRecon
Sublist3r
Wfuzz
Web Tools
Cert.sh
Searching a domain name in Cert.sh can help identify when SSL Certificates have been issued to a particular domain and subdomains.
DNSdumpster
DNSdumpster is a great tool for DNS and host enumeration. We even get a nice downloadable graph and can even export discovered hosts directly to .xlsx.
VirusTotal
VirusTotal can be used to look up sub domains of a host: https://www.virustotal.com/gui/home/search
Virtual Hosts
Some subdomains aren't always hosted in publicly accessible DNS results, such as development versions of a web application or administration portals.
Web servers can host multiple websites under the same IP. The web server is able to differentiate between requests by the value in the Host header of a request. It is possible to take advantage of this by fuzzing the host header for discovery.
Fuff
Last updated