Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

https://github.com/aboul3la/Sublist3r https://github.com/jhaddix/domain https://github.com/guelfoweb/knock https://github.com/TheRook/subbrute https://github.com/blechschmidt/massdns https://bitbucket.org/LaNMaSteR53/recon-ng https://github.com/caffix/amass https://github.com/cakinney/domained https://github.com/rbsec/dnscan https://github.com/michenriksen/aquatone https://tools.kali.org/information-gathering/dnsrecon https://www.aldeid.com/wiki/Fierce https://github.com/OJ/gobuster https://github.com/fwaeytens/dnsenum https://github.com/infosec-au/altdns https://github.com/sensepost/BiLE-suite https://github.com/tomsteele/blacksheepwall https://github.com/RandomStorm/Bluto https://github.com/anshumanbh/brutesubs https://github.com/mandatoryprogrammer/cloudflare_enum https://github.com/UnaPibaGeek/ctfr https://github.com/m0nad/DNS-Discovery https://github.com/lorenzog/dns-parallel-prober https://github.com/evilsocket/dnssearch https://github.com/mschwager/fierce https://github.com/mhmdiaa/second-order https://github.com/jrozner/sonar https://github.com/laramies/theHarvester https://github.com/gwen001/vhost-brute https://github.com/codingo/VHostScan https://github.com/jobertabma/virtual-host-discovery https://github.com/ChrisTruncer/EyeWitness https://github.com/sharsi1/sublazerwlst https://github.com/appsecco/the-art-of-subdomain-enumeration https://github.com/evilsocket/xray https://www.nlnetlabs.nl/projects/ldns/ https://dnscurve.org/nsec3walker.html https://github.com/eldraco/domain_analyzer https://github.com/christophetd/censys-subdomain-finder https://github.com/n4xh4ck5/N4xD0rk https://github.com/n4xh4ck5/V1D0m

⏳🔺33 Million Subdomain Wordlist🔻🧱🔨👀

https://mega.nz/file/UsJXzITR#TMIFTXnW1zABHfZUIKMPMvA-c8UvzGWeAd4mg4gGCtQ

cmd@fb:/tmp|❯ wc -l 33m-subdomain-wordlist.txt
 33927885 33m-subdomain-wordlist.txt

🚨🔺15 Million Subdomain Wordlist🔻 🧱🔨👀

https://mega.nz/file/BtIh2KaZ#zI1aZgAdHYdBfvKC5G8bwXwfFG11Gx0CW1zLhc0weC8

cmd@fb:/tmp|❯ wc -l 15m_sub_wordlist.txt
 15677820 15m_sub_wordlist.txt

11m_sub_wordlist.txt Download Link

https://mega.nz/file/sgRRTCYZ#2YvaeX3jPSJOtbt9M6PQzdatM-HaB6E-Wq08tjs8GzU

cmd@fb:~/Desktop|⇒  wc -l 11m_sub_wordlist.txt
11466866 11m_sub_wordlist.txt

11m_sub_wordlist.txt 137 MB

Subdomain Brute Force

cat 11m_sub_wordlist.txt | subgen -d "bing.com"> not_resolve_subdomain.txt

echo "bing.com">bing.txt
comb -s="." 11m_sub_wordlist.txt bing.txt > not_resolve_subdomain.txt

cat not_resolve_subdomain.txt | zdns A --threads 10000 --name-servers=1.1.1.1 | jq -r "select(.data.answers[0].name) | .name" |tee resolve_subdomain.txt

ZDNS Too Many open files Error Solution

ulimit -n 100000

Aiodnsbrute

sudo pip3 install aiodnsbrute

aiodnsbrute yahoo.com -w /tmp/11m_sub_wordlist.txt -o csv -t 10000 -r resolver.txt

resolver.txt=>1.1.1.1

cat yahoo.com.csv | cut -d, -f1 | grep yahoo.com>yahoo.com.txt

Subdomain+Bruteforce List Create

for i in $(cat 11m_sub_wordlist.txt); do echo $i".bing.com">>not_resolve_subdomain.txt; done   #first method
cat 11m_sub_wordlist.txt | xargs -L1 -P20 -I@ bash -c "echo @.'bing.com'>>not_resolve_subdomain.txt"   #second method
cat 11m_sub_wordlist.txt | awk '{print $1".bing.com"}'>not_resolve_subdomain.txt   #third method
while read -r sub; do echo $sub".bing.com">>not_resolve_subdomain.txt ; done < 11m_sub_wordlist.txt   # fourth method
echo "bing.com">bing.txt ; comb -s="." 11m_sub_wordlist.txt bing.txt > not_resolve_subdomain.txt   #fifth method
cat 11m_sub_wordlist.txt | subgen -d "bing.com">not_resolve_subdomain.txt    #sixth method
goaltdns -h bing.com -w /tmp/11m_sub_wordlist.txt -o not_resolve_subdomain.txt    #seventh method

List Bruteforce Create

cat 3.txt
bing.com
tesla.com
google.com

while read -r sub; do awk '{print $1".'$sub'"}' ~/a/10k.txt >> $sub_non_resolve.txt; done < cat 3.txt

Ksubdomain and Zdns Alive Subdomain

cat resolve.txt
1.1.1.1
8.8.8.8

sudo ksubdomain -f not_resolve_subdomain.txt -e 0 -verify -o resolve.txt -s resolve.txt

cat not_resolve_subdomain.txt | zdns A --threads 10000 --name-servers=1.1.1.1 | jq -r "select(.data.answers[0].name) | .name" |tee resolve_subdomain.txt

Simple Brute-Force Bash Functions

#!/usr/bin/env bash

if [ "$#" -ne 1 ]; then
    echo "brute.sh domain.com"
        exit 1
fi
bruteforce(){
    domain=$1
    wordlist="/tmp/1000.txt"
    #wordlist=$2
    printf "[*] Bruteorce $domain Start"
    printf "                        \r"
    cat $wordlist | awk -v url="$domain" '{print $1"."url}' > /tmp/notresolve-$domain.txt
    cat /tmp/notresolve-$domain.txt| zdns A --threads 200 --name-servers=1.1.1.1 | jq -r "select(.data.answers[0].name) | .name" > /tmp/bruteforce-$domain.txt
    cat /tmp/bruteforce-$domain.txt | grep -Eo "[a-zA-Z0-9._-]+\.$domain" | sort -u > resolve-$domain.txt
    rm /tmp/notresolve-$domain.txt /tmp/bruteforce-$domain.txt
    echo -e "[+] $domain Brute-Force Done : $(wc -l resolve-$domain.txt | awk '{ print $1}')"
}
bruteforce $1

#*Demo*
#wget https://raw.githubusercontent.com/rbsec/dnscan/master/subdomains-1000.txt -O /tmp/1000.txt
#bash brute.sh tesla.com

#Resolve 
#cat /tmp/notresolve-$domain.txt|zdns A --threads 500 --name-servers=1.1.1.1 | jq -r "select(.data.answers[0].name) | .name" >/tmp/bruteforce-$domain.txt
#cat /tmp/notresolve-$domain.txt|dnsx -l -t 200 -o /tmp/bruteforce-$domain.txt
#cat /tmp/notresolve-$domain.txt|httpx -threads 100 -o /tmp/bruteforce-$domain.txt

Usage

bash brute.sh bing.com

https://github.com/blark/aiodnsbrute

https://github.com/Q2h1Cg/dnsbrute

https://github.com/knownsec/ksubdomain

https://github.com/subfinder/goaltdns

https://github.com/zmap/zdns

https://github.com/pry0cc/subgen

https://github.com/tomnomnom/comb

Online DNS tools

https://hackertarget.com/

http://searchdns.netcraft.com/

https://dnsdumpster.com/

https://www.threatcrowd.org/

https://riddler.io/

https://api.passivetotal.org

https://www.censys.io

https://api.shodan.io

http://www.dnsdb.org/

https://www.dnsdb.info/

https://scans.io/

https://findsubdomains.com/

https://securitytrails.com/dns-trails

https://crt.sh/

https://certspotter.com/api/v0/certs?domain=example.com

https://transparencyreport.google.com/https/certificates

https://developers.facebook.com/tools/ct

https://google.com/transparencyreport/https/ct/

https://www.certificate-transparency.org/known-logs

Subdomains bruteforce Wordlists:

https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056

https://github.com/danTaler/WordLists

https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS

https://room362.com/storage/saved/hugelist.txt

http://wordlist.aspell.net/other-dicts/

https://www.openwall.com/wordlists/

http://www.outpost9.com/files/WordLists.html

https://packetstormsecurity.com/Crackers/wordlists/