search

TheRook / subbrute

A DNS meta-query spider that enumerates DNS records, and subdomains.
GNU General Public License v3.0
3.35k stars 653 forks source link

Get subdomains via additional recon (Search Engine, Alternative Sources) #33

Open creolis opened 8 years ago

creolis commented 8 years ago

This is more or less linked to #31, as it is just another idea to get more hostnames during the recon process :)

Google and Bing: Scrape Google and Bing using the site: modifier. Example: "site:foo.com" Parse the result set for individual subdomains.

Also:

AXFR: maybe a Zone transfer is possible, which would result in a comprehensive list of returns and therefore you can back off from brute force and safe time at that point :)

DNSSEC aware zones could be prone to zone walking, which is another great way to get a list of hosts in a considerable amount of time.

A rather "active" approach (which involves direct connections) could be to access each found host on port 80, retrieve the standard vhost and the vhost you found and look if you get a HTTP 302 Redirection - it may include further hints to other subdomains.

TheRook commented 8 years ago

Subbrute tries an axfr against every authoritative ns record, because one of the servers maybe misconfigured.

As for non-dns methods, the next major version will open the flood gates for custom discovery.

On Wednesday, January 27, 2016, Daniel Haslinger notifications@github.com wrote:

This is more or less linked to #31 https://github.com/TheRook/subbrute/issues/31, as it is just another idea to get more hostnames during the recon process :)

Google and Bing: Scrape Google and Bing using the site: modifier Example: "site:foocom" Parse the result set for individual subdomains

Also:

AXFR: maybe a Zone transfer is possible, which would result in a comprehensive list of returns and therefore you can back off from brute force and safe time at that point :)

DNSSEC aware zones could be prone to zone walking, which is another great way to get a list of hosts in a considerable amount of time

A rather "active" approach (which involves direct connections) could be to access each found host on port 80, retrieve the standard vhost and the vhost you found and look if you get a HTTP 302 Redirection - it may include further hints to other subdomains

— Reply to this email directly or view it on GitHub https://github.com/TheRook/subbrute/issues/33.

creolis commented 8 years ago

Ah :) Didn't realize it already does axfr because I did not see an option switch for that, but I must admit I didn't look at the sources yet. Next major will be exciting then :-)