Hello everyone and welcome to this lesson.
So in this lesson, we are going to see how you can supply a
list of URLs instead of supplying one
target how you can supply bunch of
hosts to nuclei.
To do that we would require a bunch of host this
time.
So what I'm going to do is I'm going to use the
tools SubFinder to do subdomain enumeration.
Now to set up SubFinder, you can simply install go
Lang into your system and download some
finder using this command.
Or else you can simply go to the releases Tab
and you can download the compatible version for your
system as well.
So let us quickly run some
finder and insta domain and identify a bunch
of subdomains for that program.
So I'm going to use nmap.org and
I'm going to hit enter when I
do that the output will be shown onto my
screen.
I want to see if this output as well. So I'm going to specify hyphen o
which stands for output and I'm
going to say in map substart txt and
hit enter.
Now you can see a message which says enumerating subdomains
for nmap.org.
You can see we have identified 35 such subdomains
in five seconds and 734
milliseconds. Let's say it was real quick
subdomains like scan me can
be seen over here and so on.
Now if you look carefully you have
identified a bunch of hosts, but we
don't know if these hosts are live or dead
because SubFinder uses passive subdomain
enumeration technique, which is basically collection of
these host from different data sources.
So we would now validate how
many of these hosts are live that can be
supplied to nuclei for vulnerability scanning nuclei
requires the bunch of host as an
input with a protocol that is HTTP or
https.
To do that we are going to use another tool
which is created by the same team, which is
httpx. You can install this tool similarly using
golang or else you can download the
compatible version from assets from
here for your system as well.
So this time let's pass these results that
we have downloaded to httpx in the
form of a list that can be specified with
httpx hyphen L and end
map substart txt.
Let's see if this results into a file called as nmap Subs.
live.txt
this would give us a good output of host which
are life as you can see. This has completed
very quickly. Let us count how many
host we have identified to be life.
You can see 34 of these host word life.
Now. How do we Supply this to nuclei?
We can supply it using two ways. The
first is as a standard input. So I'm
going to read this file, which is the live.txt and
Supply it directly to nuclei for a
specific template that I want to run. So
let's say Technologies and nginx.
I'll hit enter and this will start running the
specific template that I have supplied on the
bunch of hosts as you can see over here.
The second way to do that is specifying nuclei
and specifying the list that
we want.
with the help of hyphen l
Nmap, Subs live.txt Supply the
template path.
Which is over here.
and hit enter
and this would again start running that specific
template on bunch of host that
you have for any bug Bounty program. It could
be the list of subdomains or resolved
IP addresses with the protocol and a
port number as well.
So I hope you guys understood how you can use nuclei to
scan a bunch of hosts or
targeted domains and subdomains as
well. Thank you.