Posts tagged: #Enumeration

dnsenum

Performs various dns-level and osint searches to find sub domains.

dnsenum \
  --enum target.tld \
  -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt

gobuster

You can do virtual host subdomain brute forcing with gobuster. You can specify the target as a hostname or ip.

gobuster vhost \
  -u http[s]://targetip[:port] \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  --append-domain

You can do a DNS zone transfer using dig by using axfr

dig axfr @dns-server.com target.tld

This will return all dns records for target.tld. It’s intended to copy all records from a primary to secondary server and should only happen if trusted, but misconfigured servers may allow unauthorised transfers allowing for enumeration without brute forcing 🌿 .