Original subtitles

OK so we have our results back in part one we went pretty quick.

Part Two I want to talk about the results what might be interesting here and then identify some other

tools that you can download and use and go play with on your own.

So this has identified quite a few things.

I mean there's a big list here.

Eighty seven subdomains and I lied to you and I said that it didn't get forth levels.

I thought there used to be a recursive feature where you'd have to do a dash are to get those.

Now you don't have to do that.

It just picks up pork bellies for you.

Now some blister is great at finding some of these things like we come through here.

There is a dabbed Tesla dot com and I saw down towards the end that there was some staging staging to

here a dev here a test.

These all look juicy SS dash Dev looks juicy I might be after something like Q A as well or something

like a VPN dot Tesla dot com.

I want to know where your mail is at.

So here's web mail ex mail anything here.

You can also look through these lists and possibly identify what kind of tools they're using you might

see something like a link dot Tesla dot com or zoom dot Tesla dot com and this really just kind of drives

home what they're running on their back end for a lot of things now this isn't the all inclusive sub

Lister is a great tool sub Lester was ahead of its time when it came out but there are better tools

out there there are tools that incorporate pretty much everything in one go.

So you might have certain essays like this you might have sub lesser included in the one tool that is

really popular if you go to Google type in a lost a mass and this is the go to tool for a lot of people

doing bug bounty hunting.

So if we click on the AIM ask project here in GitHub you can download the project and install it.

Per the installation instructions here.

So you have an installation guide down the documentation.

The reason I have chosen not to show it in this series is because actually running a mass takes a long

time but you can configure a mass to do a lot of things and find a lot more subdomain.

So my challenge to you is to get a mass install and on top of that see how many more subdomains than

eighty seven can you find when you actually run it.

So another last thing to point out is if you want to use some bluster and you were used it was really

really slow.

It's always helpful to check the dash H on the help and you can see in here that there is a dash T for

threads always check the help so we can specify a domain like we did before do something like dash D

of Tesla dot com and then you can specify threads of like 100 as opposed to maybe one thread or 10 threads

I was running originally.

We give it 100 thread it's an a go a lot faster we're gonna get a lot more results.

You could also do a dash V for verbosity here and get your results in real time if you're impatient

or you're trying to go out to the Web.

So there are great tools out there for doing subdomain hunting and again subdomain hunting is very very

critical because if we just limited ourself to Tesla dot com look at all the things that we would miss.

So we can find out a lot here.

Now not all of these pages are going to be alive.

Also there's a good possibility that we can go to something like this MFA dot Dev or dash Dev dot Tesla

dot com and it won't work.

We can give it a go and see.

Like now always do these work these are what's show up in search engines.

But it's worth knowing about them.

And there are other tools out there such as like go to Google such as Tom h t t p probe like this.

Tools like that out there that will probe the list that you give it and give it this list into the probe.

It'll say hey this Web site's alive or this Web site's not alive.

And then you can start narrowing down these lists as well.

So that is something to think about when you get your wheels spinning.

But for now for information gathering in for the scope of this course we don't have to worry about too

much.

They do want to point out some other alternatives and ways to do subdomain hunting and then what to

look for in subdomain hunting.

So that is it for this video.

I'm going to catch you over in the next one.