All language subtitles for 6. Hunting Subdomains - Part 1

The next several videos are going to talk about Web information gathering.

So this is going to be important because a lot of the times we're going to be tasked with a web penetration

test or we might encounter a Web site on an external or internal penetration test.

And being able to gather information and perform enumeration on those Web sites is super important.

So what I'm going to show you through out is how to gather some of the information passively that is

out there and then we'll talk about active methods that actually involve going out to the Web site and

gathering information that way as well.

So the first and most important thing especially when it comes to Web sites or bug bounty hunting etc.

is that we need to identify what sub domains are out there and you saw earlier when we were looking

at Tesla.

It had a scope of something like Asterix Tesla dot com.

This Asterix is a wild card.

This means that anything and everything is open to us in the scope except it was out of scope in the

subdomain range.

Now we can utilize tools to our advantage to discover these subdomains why are subdomains important.

Well we might run into something that is like a dev dot Tesla dot com or we might run into a Web site

that should've never been out there right.

Like the dev or like test site dot Tesla dot com for example or you might find logging forms another

reason that it's so important is because if you just look at Tesla dot com you're limiting yourself

to one website where there could be potentially tons of Web sites on these subdomains.

So we really really need to hunt these and be certain that we're incorporating everything that we can

we're doing our assessments.

So one great tool that I want to point out is a tool called Sub Lister.

Now we need to install that.

Let's type an apt install sub blister like this

OK.

And this will just take a second to get it all set up and we will utilize this tool to get these subdomains.

OK.

Now that it's setup all we have to do is type in some blister hit tab for auto complete hit enter and

it gives you the syntax.

We can do a dash dash H for help or dash H for help and all we really need here is a domain so we can

say dash D for Tesla dot com and it's going to start searching for Tesla dot com.

And don't worry about this error if you get the error.

So it's looking through all these different search engines similar to what the harvester was doing.

But you're going to see that it's returned quite a bit more so we see by do Yahoo Google go through

all these and try to search.

Now while this is going on I want to point out another way to do this.

So let's go out to the Web and let's go and load up another site called CRT the S H with a CRT the age

like this.

Get a load up a Web site like so let's make this a little bigger for you.

And we can do the wildcard ourselves.

You see the percentage is a wild card.

So we're just gonna say percent Kessler dot com.

Now all we're doing is we're using cert fingerprinting.

Now we're gonna go out and look for certificates that have been registered and it's going to attempt

to find those and tell us what's out there so you can see that we can find energy support at Tesla dot

com grid logic the energy the Tesla dot com and we would scroll through these and try to identify all

the different ones like SS so single sign on that might be interesting if I could find anything in here

that's like VPN that Tesla dot com or Deb Tesla dot com any sort of thing like that.

I'm also interested in it API tool box could very well be interesting.

SS o dash Dev dot Tesla dot com.

So these are the sort of things that we're after and you see right now that we have different levels

to domains like here you see that we have our subdomain but what about a sub subdomain like a fourth

level of a domain.

You see grid logic the energy that Tesla dot com.

So we can go deeper and deeper when it comes to these domains and what Seltzer is going to be doing

right now is it's going to try to find just the sub subdomain.

So it's going to look for third levels.

It would not discover this grid logic that energy at Tesla dot com without a little bit of the nagging

and looking through the help to figure out how to do that.

So we can come to a site like CRT s h to see if we could find any additional subdomains within this

and we can utilize tools like sub Lister as well.

So I'm going to let this finish but in the next video I'm going to show you is I'm going to show you

how to improve upon this process with some tools that have been written in go that I think are fantastic.

So I'm going to let this run we're going to have part 2 of this video we actually review the results

and then we'll go from there.

So I will see you over in the next video.