search

OJ / gobuster

Directory/File, DNS and VHost busting tool written in Go
Apache License 2.0
9.65k stars 1.18k forks source link

Is it possible to scan domain like https://pubaccount10086.blob.core.windows.net? #467

Closed supasaf closed 10 months ago

supasaf commented 10 months ago

I just found gobuster, it's great!

In order to test gobuster, I created an Azure storage account, set it to public and uploaded a tmp.txt file to it, so basically we can access the file from: https://pubaccount10086.blob.core.windows.net/ftest/tmp.txt

image

I created another file for testing:

❯ cat subnames.txt
pubaccount

With command:

❯ gobuster dns -d blob.core.windows.net -w subnames.txt --wildcard
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Domain:            blob.core.windows.net
[+] Threads:           10
[+] Wildcard forced:   true
[+] Timeout:           1s
[+] Wordlist:          subnames.txt
===============================================================
Starting gobuster in DNS enumeration mode
===============================================================
Progress: 1 / 2 (50.00%)
Found: pubaccount.blob.core.windows.net

===============================================================
Finished
===============================================================

It sounds like subdomains like pubaccount10086 can't be found, not sure if I missed something?

firefart commented 10 months ago

it can find everything you put in your wordlist. if you don’t put it in your wordlist, it won’t be reported