So the next tool on our list is h t t PRO SO WE CAN TYPE h t probe like this and we'll just say get
hub.
And guess who makes an appearance again is our friend Tom.
Nom Nom.
So we're gonna go ahead and just download this another go tool.
Go ahead and copy this and paste it in.
Over here it's gonna clear the screen.
Paste this.
Let it download.
And we're using this to ensure that what we're doing when we we run asset finder for example that these
come back alive or not.
So we want to know if the hosts are alive.
So what we're gonna do is we can say something like we have that file we have the final that text right
and we can say hey find all that text we can cap it out we go Tesla dot com recon final that text and
cap that.
Now we want to say h t t pro and that we'll just go out and it will say hey do you respond at all when
I send something out to you.
I'm gonna make an H cheeky P request.
I'm going to make an H G.P.S. request and it doesn't matter if it is a status code two hundred says
go three hundred four hundred whatever it just wants to know if it responds and if it responds that
tells it that it's alive here.
OK.
So what we're gonna do is I'm going to go ahead and control C on this process and let this stop and
we're going to narrow this down just a little bit.
So on HBP probe itself I'm going to do a dash s which is just going to remove all the default ports.
So it's scanning on 80 and four for three.
For me I have automatic DNS happening on port 80.
So I'm only going to search this on for for 3 if you do not have automatic DNS.
That's fine.
You can leave this as is by adding this extra option just for myself.
So we know how many false positives.
So on top of this I'm going to hit enter and just let you see what's happening so now it's only searching
at HDP s and what's coming back.
The control C on this next.
I want to do something here.
I want to remove you can see it comes off the CPS double that slash slash and 4 or 4 3.
That's great.
However I want to scan these and we're going to take this in the next video we're going to we're just
going to continuing our automation and just talk about some things that we can do and I'll show you
my script towards the end of this section of a longer script that I have that I utilize.
So here we're going to remove the HD G.P.S. off of this so we can actually scan this with and map and
we're gonna do here is we're just going to use said.
And if you remember from previous videos I am not a said master so I just googled this.
If I'm being straightforward with you here.
So I'm going to say.
Question Mark and feel free to copy exactly what I'm doing just like this.
So this in theory should now strip off the G.P.S. off the front.
We also need to take off the four for three off the back.
So if you recall we can use truncate for that or translate I should say dash D and then we just say
4 4 3 be gone.
So now we hit enter and it should start pulling this down.
It might take a second to actually probe through this and pull it down now that everything has been
stripped down and set it out but it's going to pull these down and it's going to come back and it's
going to say hey instead of having each G.P.S. in front everything and four for three at the end it's
just going to have these subdomains and just like this perfect timing.
So just the subdomains that we want here and they're all going to be stripped down perfectly for us.
So with that let's go ahead and copy this copy this whole long thing we're just going to take it the
we'll take this here and we'll change this just a little bit.
So copy this and we're going to echo something like we're gonna say
probing for alive domains.
And then we'll just paste this here.
But what we'll do instead of Tesla dot com will dollar sign your URL.
OK.
And then we'll put in the one more thing is we're going to sort this by unique we'll say sort unique
that way.
Anything that's in final that text that hasn't been sorted by unique.
This is where we get rid of a here.
OK so sort unique is going to take rid of all the duplicates.
Then we'll run it through HDTV probe.
We'll set that out.
Get rid of that four four three here and then we're gonna put this all into a file called a live dot
text.
So we'll say your l recon alive Doc text and there you should have it.
So if we save this and now we go ahead and we just run run dot s h and we say Tesla dot com it's going
to harvest the subdomains asset finder you shouldn't see anything come through then it's going to probe
for the alive subdomains.
We should be creating a file right about now that has the alive subdomains and here we go into files
go into Tesla dot com recon and then alive that text is there.
It's just it's working on it right.
So nothing's going to come in right away.
It's going to take a minute but that's that's really it.
That's all we're trying to do at this point and I want to bring that back.
And so here we have our script it's worked.
Let's go and check it now.
So alive that text now has all these different lived subdomains.
So we would go through here and we can look through these we can enumerate these.
And this is the point that we wanted to get down to.
We wanted something that we can enumerate now.
Right.
So we can go and cat Tesla dot com
recon and we could say alive dot text and then I can sort through these if I want to find something
interesting or I can graph and say like grep on Dev.
OK there's a dev grep on test or staging as THG.
Those are always good ones or admin looking for AB and panels are always good ones as well.
And you just want to look through these and see where something might be of interest.
Any kind of test domain or any kind of a dead domain or anything like that will be very very interesting
could potentially lead to some good findings.
So from here we're going to go ahead and move on to one more tool that I like to utilize in this step
when it comes to this automated enumeration.
And then we'll go ahead and tie it all together all this show you what one of my longer scripts looks
like and then we'll start working on the lost top 10 attacks.