Now, once we get the authoritative DNS server address by using who is, we can identify any additional
hosts in the domain such as FTP server, mail server and so on.
If there are any other services in this domain, we can also extract information from them.
Now, another way to discover subdomains and the host is to query search engines.
And then you can compare the results.
OK, so here you might be confused about Hosten subdomains, so let me give you a quick explanation.
If you think of the address, exact example, dotcom, now X is the subdomain of example dotcom.
And exact example, Dotcom can be a host if it is connected to an IP address and resolves to a computer
when one goes to exact example, dotcom.
Q So anyway, there are multiple ways to extract additional Hosten subdomain information, so that means
there's lots of tools out there for us to use on this purpose.
And I'm going to use two tools that are already present in Colly Fears and the Harvester now Fears is
a really cool tool.
Besides that, it uses brute force methods to get subdomains.
Also, after it finds a valid host, then it performs a reverse lookup to uncover additional hosts.
And here are the options for fears.
OK, so first we're going to run a basic scan so type fears dash DNS, Google dot com dash thread's
10 dash files, bagrut slash desktop slash Google info, dot text and hit enter.
So the DNS parameter specifies the domain that you want to scan.
So in our example, it is Google dotcom.
By default, fears runs in a single thread mode, so because of this.
I can add the threads parameter to increase the speed.
So that makes the scan run faster and then the final parameter helps us to save the results to a file.
Now, while scanning the hosts or subdomains.
What happens in the background?
So fierce first tries to find the DNS servers for the target domain.
The next, as I'm showing you on the screen, it attempts to do a zone transfer.
Now, at this point, if a zone transfer is successful, Fierce will stop running.
And then you can take that information that you got from the zone transfer.
Now, if zone transfer fails, as it has in our scan, it checks if wild card DNS is enabled.
And then he performs a brute force against the domain using its built in wordlist.
OK, so now the scan is complete.
And as you can see, once his skin is finished, the found subdomains and discovered subnets are listed.
We can also view and save the file.
But the content is not that different, in fact, is not different at all from the output on our screen,
just makes it convenient.
And by default, Fears uses its own built in wordlist.
But it also provides the ability to use a custom word list that you can build and sometimes different
word lists can uncover new subdomains.
So the second tool is the harvester.
It is another subdomains scanner and it gathers public information such as employee names, email,
subdomains, banners and other similar information.
For now, we're just going to deal with subdomains and host.
And hype the harvester.
And you'll see options.
Now, it's quite easy to use this tool, so let's just run it quickly.
Type the harvester dash d and the domain that you want to search.
So in my case, of course, it's Google outcome.
It might be strange because I will be using Bing to search for Google dotcom.
But by using the B parameter, you can provide a data source el parameter limits the search output.
So the harvest will analyze the first 500 search results of Bing about Google dot com.
And finally, the F parameter helps us to save the result to a file.
OK, so hit ETAs run.
And first, the searches conducted.
Then it will analyze a result.
OK, so here's what we expected to see.
So now.
Go to the saved file directory.
Going to go to the desktop and here's a file, so let's have a look.
So it's not very different from the output that's on the screen.
At least we can have smaller graphics.
Great, so you can run these tools or some other ones if you wish for your target.
You can go ahead and practice at.