Hello, everyone.
So when we are doing subdomain takeover the first and the foremost important step that we have to do
is a subdomain enumeration, and obviously when we are doing subdomain enumeration, we want two things
that are very important for us.
The first thing is more number of results, which contains a lot of subdomains of that specific target,
because we do not want to miss any of the subdomain which may be vulnerable to subdomain takeover attacks.
So the first thing that we want is the maximum number of results or subdomains into our output.
Now, what is the second thing that we want?
Second thing is the fastest subdomain resolvers, which basically means in simple word, we
want the maximum number of subdomains in output with the minimum amount spend, which is very important
for every one of us.
We just cannot sit there waiting for long hours, waiting to get the results of a subdomain enumeration.
So what we need to do, I have already done the comparisons for the fastest, fastest subdomain resolvers
that can help you in quickly processing the subdomain enumeration part so you can focus more on the
subdomain takeovers of the of those particular targets.
So let's quickly see how you can do this.
So it is a practical time and let's see the fastest subdomain enumeration, resolver or tool with better
and accurate results.
All right, so the first thing that we are going to see is the usual sublister tool that everyone
uses for identifying the subdomains or doing the subdomain enumeration.
So I'm just going to hit, enter and wait for this to complete.
As you can see, it has successfully started.
Let me also run one instance of find domain and let's see what results do we get.
I'm just going to run find domain and I'm going to type hyphen D, which stands for Target and I'm going
to run this as soon as I run this.
It is going to give me the results.
And you can see I have got the results in four seconds, which was a very, very quick sublister has
not even started before this.
I got the results in simply three seconds and this time it took one more second to give me the results,
which is a very, very awesome.
Now let's see if we get the subdomain that we want over here and let's see the results of do we get
the subdomains that we want from this specific target.
Let me just scroll the results and you can see here, which is perfect.
We are able to see the subdomain that we wanted, which have been hosted recently, which is Shifa
.shopify.srsecure.xyz.
And we have already taken over this subdomain, which was a vulnerable to Shopify subdomain takeover.
Now let's get back to our sublister and see how much it has done until now.
And again, see, it has also completed the subdomain enumeration part and it has identified the subdomains
as well.
And you can see it has also identified the subdomain that we want, which is shifa.shopify.srsecure
but in the race of identifying subdomains.
It has identified these subdomains by taking a lot of time.
But the number of subdomains you can see are more than find domain.
As we can see, it only got 47 subdomains and here we have 57 subdomains.
I believe that many of the subdomains are repeated over here.
For example, the www is added again for each subdomain because of which the number of results that
we have got has doubled over here, as you can see over here.
And if you see the output for this, there are again, www which have been added over here.
But when I did the comparison for both the number of URL, it were exactly the same.
So this produces a big count, but exactly those URL which resolve and are running or live
is exactly the same for both the tools.
Now, if comparing that time, then the time, obviously, as we have seen of find domain is very,
very good.
In just mere four seconds, it was able to identify all of the subdomains.
So we are saving our time onto that.
So I hope you guys understood this comparison video of identifying the subdomains for enumeration so
that you can use this later on for your target.
Now, before closing this video, let me show you one more thing as well.
Now, if you want to save the results of find domain, you can save that as well.
You can use this particular symbol and give the name of the file that you want to save.
So let's say I want to save this into this file, which is the name srsecure_sub.txt
Now, let me just hit enter and it will save the output into this file.
And you can see it has completed.
Let's verify.
And you can see this as the result, and now it was able to identify the subdomains and three seconds
what you can see into this output, we are able to see a lot of more thing, a lot of messages over
here.
And the target and searching in virustotal, sublister, Facebook ,bufferover API.
So we do not want this clutter over here.
So what we are going to do is we are going to run the command, which is hyphen, hyphen, quiet and
enter.
What this will do is it will quiet the find domain output and it will not print any banner.
So let me show you the output now and you can see a clear output with only the subdomains.
There is no extra clutter or noise into this output.
And now you can utilize this output as well.
You can save it and you and you will be able to make a clear distinguish and clearly identify what are
the subdomains.
And you can also feed the subdomains to any other tools if you want to move ahead with this target.
So this is it for this video.
And I hope you guys understood how you can quickly identify subdomains for any specific target.
Thank you.