Hello, everyone, and welcome to this video.
So in this video, we're going to understand about a subdomain enumeration, as in the previous video,
we have already understood about what is a subdomain.
Now we will see how you can enumerate a subdomains.
What is the difference between a vertical domain correlation and horizontal domain correlation?
So there is something which is also known as a sub subdomain that we discussed about in the previous
video.
So let's quickly understand about vertical domain correlation.
So all the subdomains of domain, for example, let's say Google dot com.
So one of the sub domain of Google dot com would be maps.google.com.
This is an example of vertical domain correlation, which means any sub domain of a particular base
domain or top level domain, whereas in horizontal domain correlation it contains the acquisitions of
the top level domain or the base domain.
For example, Google.cz, YouTube dot com, Blogger dot com.
All of these are the products of Google, which means they are some of the another way connected to
the base domain or the top level domain or the organization, which basically means anything that is
acquired by Google as an entity is considered to be horizontal domain correlation.
Now, is it really important or would it to identify security flaws into the acquisitions by any parent
organization?
Yes, there are many examples of bug bounty programs wherein acquisitions are also considered to be
in scope.
For instance, Facebook is runs a bug bounty program.
Facebook runs a bug bounty program, which also includes all of its acquisitions.
Similarly, Google also includes all of its acquisitions into the bug bounty program.
Similarly, Apple also includes all the acquisitions under its bug bounty program and so on.
So as of now, we have understood about vertical domain coordination, horizontal domain correlation.
So how do we actually identify these types of domains or subdomains?
So there are some of the open source tools that can be used to identify this, and we are going to use
most of them into the next upcoming videos.
So I like to use a sub finder because it is written in go lang and because of speed and concurrency,
it is considered to be one of the fastest tool to identify subdomains for any given target.
There are multiple tools that can be used to identify some domains like Amass, Sublister or Aquatone or
Knockpy, but at the end they're going to get the same results from all of them.
So we basically want to save our time.
So we are going to use some finder into the upcoming videos wherein we will identify multiple subdomains
in a lesser span of time.
So in addition to the finder, I also like to find subdomains manually because that is the time.
Then we may get a new subdomain for any target.
For that, we are going to use crst.sh, which basically is the certificate transparency log in which
if any new certificate has been assigned to a top level domain or its subdomain, they are going to know about
that.
Second is censys.io, which is an IOT connected search engine from where we can also identify
given subdomains for any target similar to censys is Shodan, which is again an Internet connected
search engine where we can identify about multiple targets and the subdomains Google certificate transparency
logs is again the certificate logs from which we can identify the subdomains for any given target, Facebook
certificate.
Transparency is similar, like Google certificate transparency.
Then we can identify subdomains based on the certificate logs.
We can also identify subdomains using CSP header.
We can also identify some domain based on the DNS records.
By using viewdns.info website, dnsdumpster.com, as well as virustotal.com.
So I hope you guys understood this.
Thank you.