Comprehensive Guide to Discovering Hidden Subdomains: RedHat Teamign

Photo by Markus Spiske on Unsplash

We are going to use every single way to find all supplements free on the internet. Google Dorking , PHP Shell , JavaScript Bash , Python and all the famous high-level programming languages that are possible maybe in some cases we use machine learning and artificial intelligence help to complete the story.

The use of “Macheen Learnig” will be last to calculate the data and check how many duplicates we have. to chack any duplicate Subdoains. :)

we are going to use several tools. also try to use everything a possible way to Emuenrate the Sub-domains on server so let’s begin with the few techniques that. I am going to use and its actually free of cost so you will be easy to process.

list of advanced subdomain enumeration techniques

1. DNS Enumeration Tools
2. Brute Forcing
3. Wordlist Customization
4. Use Certificate Transparency Logs
5. Google Dorks
6. Reverse DNS Lookup
7. APIs and Data Enrichment
8. Spidering and Web Crawling
9. Common Name Mismatches
10. GitHub Recon
11. Social Engineering and OSINT
12. Brute Forcing DNS Records

10 Tools That I use For Sub-Domains Finding

1. Amass

Amass:

Advanced Enumeration with Active Scanning and Brute Forcing:

So it goes on the internet and sends a request to all the search engines about your subdomain and goes to all the sites that are doing all these things. Some of these websites have been mentioned below. Specifically, it relies on search engine and it notes all the DNS packages by sending a request.

It is very important to take some precautions while using the script, one of which is having a proxy is very important. It affects and can damage your processor to many extents.

amass enum -d example.com -active -brute

Using a Configuration File for Advanced Settings:

amass enum -d example.com -config ~/advanced_config.ini

Enumerate Subdomains and Output JSON Results:

amass enum -d example.com -json output.json

Performing Advanced Enumeration with Specific Data Sources:

amass enum -d example.com -src -ip -active

Exclude Subdomains from Enumeration:

amass enum -d example.com -exclude subdomain1.example.com,subdomain2.example.com

Setting Maximum DNS Query Rate and Maximum DNS Request Rate:

amass enum -d google.com -max-dns-queries 1000 -max-dns-ref-reqs 200

Enumerate Subdomains Using a Custom Wordlist for Brute Forcing:

amass enum -d example.com -w custom_wordlist.txt

Using a Custom Output File for Advanced Tracking:

amass track -d example.com -o custom_output.txt

Advanced Enumeration with Passive DNS Data:

amass intel -d example.com -passive -pfd

Fetch Subdomains from Certificate Transparency Logs and Output JSON:

amass intel -d google.com -ct -json output_cert.json

Fetch Subdomains and Resolve IP Addresses:

amass intel -d example.com -src -ip

Perform Web Enumeration on Subdomains:

amass enum -d example.com -v -dir custom_wordlist.txt

1. DirBuster
2. Gobuster
3. wfuzz
4. Certspotter
5. CTFR (Certificate Transparency for Reconnaissance)
6. dnsrecon
7. massdns
8. Shodan

All these tricks are methods that can be used at an advanced level, if seen, they are at an advanced level, but they pose many problems.

Using Kali Defults Tools For Subdomains:

There are many tools within the links that can make finding subdomains even easier. But by far the tool I liked the most was Up in DNS. I am going to name some tools that will be very helpful especially if you are a whitehead or blackhead hacker. In this Artical , let’s discuss the top 10 subdomain search tools that can help you discover subdomains.

Sublist3r

Sublist3r is a python-based tool for listing subdomains of a website. It can collect subdomains from various search engines like Google, Yahoo, Bing etc. Moreover, it can also find subdomains from the list of domain names, allowing you to discover subdomains in batches.

Amass

Amass is a command line tool that can find subdomains by crawling web pages, search engines, and passive DNS sources. It is a powerful tool that can help you find subdomains quickly and efficiently.

Subfinder

Subfinder is an open source tool for discovering subdomains.It can find subdomains using various search engines including Google, Yahoo, Bing, etc. Additionally, it can discover subdomains using passive DNS and other sources.

Knockpy

Knockpy is a python-based tool for discovering subdomains by brute-forcing DNA. It can also search for subdomains using search engines and passive DNS sources. Additionally, it can verify subdomain takeovers.

Subbrute

Subbrute is a python-based tool for discovering subdomains by brute-forcing DNS. It can be used to find subdomains of a single domain or multiple domains.

Aquatone

Aquatone is a tool that can be used to browse websites. It can find subdomains, take screenshots of web pages, and perform other reconnaissance activities. Moreover, it can be used to discover subdomains using various sources.

Recon-ng

Recon-ng is a reconnaissance framework that can be used for subdomain discovery. It can find subdomains using different sources including search engines, web archives, etc. Additionally, it can be used for other recognition activities.

Subdomainizer

Subdomainizer is a tool that can be used to discover subdomains from websites. It can also be used to find subdomains from a list of domain names.

Additionally, it can be used for other recognition activities.

Finddomain

Finddomain is a tool that can be used to discover subdomains of websites. It uses various sources to find subdomains including search engines, web archives, etc. Moreover, it can also be used to search subdomains of multiple domain names.

AltDNS

AltDNS is a tool that can be used to discover subdomains by generating permutations of domain names. It can be used to find subdomains of a single domain or multiple domains. Additionally, it can be used to find subdomains using search engines and other sources.

Finally, Subdomain Finder is an essential tool for website crawling, vulnerability assessment and penetration testing. The tools above are the top 10 subdomain search tools that can help you discover subdomains quickly and efficiently. However, it is crucial to use these tools ethically and responsibly.

Free Tools that work batter:

There are many websites and tools on Google that do all this work for free. But things stop there where we shouldn’t stop. Within them we get some limited permission in which we can scan things. We can find out how many domains a website has because of the below tool Dnsdumpster.

Dnsdumpster provides you with information about DNS and also tells you how many possible servers are connected there, it also tells you the location of servers and other things that you should know.