In this video we're going to do something along similar lines with the previous lesson.
We're going to learn how to discover subdomains and find find out if you're new to penetration testing.
You should know that subdomain discovery or subdomain enumeration is a very important step in application
testing or better said in the recon phase of the penetration testing methodology.
Now there are many very good tools that can be used for this purpose.
Therefore you can just go to get help that com clone a repository and have your automated tool discovery
subdomain set up in no time.
Now I use some of these tools myself.
Tools such as derp.
So we have there there there or go bust or their search.
So all of these tools are actually used for subdomain discovery.
Now without wasting too much time let's actually do it.
So first I need to mention that inspiration for this code comes from app to rock kids.
I hope I don't butcher his name from the Python code dot com website so I'll link to it in the resources.
OK now let's first import requests.
We already know requests from the previous video and we'll also import the service module or import
says because we want to provide our domain as a command line argument.
All right now we need a list of subdomains that we want to test for it and I'm using the list from this
ripple.
So I'd be sacked.
DNS scan subdomains one thousand sixty
alright but you can choose the whatever list you want.
So I already downloaded that list and saved it in the folder where this script is going to run which
is on the desktop.
So I'll just open it let's say sub d or sub underscore or list equals 0 1 subdomains 1000 to 60 thought
Reid.
So we open it and read it in one line.
Now this will contain new line characters after each line.
So we actually needed to split it better said that this sub list variable is actually a string so a
string of words separated by the new line character now.
Oh we want what we want is actually a clean list of words that we can use to brute force or to enumerate
domains.
So we'll say subs equals sub underscore the list split lines.
And that's the method that we use.
Now in this case subs is going to be a list here.
So far so good.
Now for the fun part.
Let me explain how this works how a sub domain brute force works.
First you have a list of words.
So number one you never list of words to try as a sub domain for a specific domain.
Then number two the script makes a request to each word that subdomain dot com and it analyzes the response
whether whether you're going for HDTV or DP Yes.
And then number three based on the response we get valid subdomains.
All right.
Now how do we actually implement this in Python.
Well I'm glad you asked.
So let's actually start with the for loop for sub and subs.
So for each word and sub list or in subs list we'll go for H2 schema here for rapidity but you can test
for both HD DDP and ETP as if you want.
So I'll see you l on their sport to check equals F and I'm going to explain shortly.
H GDP sum.
So for some we take sub dot start r v V1 now f here if you didn't know starting Python three point six
we have f strings.
Okay so f in front of a string here is a string format what's in the accolades is actually taken as
a name from the current context.
There are many ways to do string for months in Python and in my view this is actually one of the cleanest
and the coolest.
Now for efficiency we should actually encapsulate everything in a trait except construct.
So we'll say Try requests that get you are all to check simple.
And then of course we have the accept but not for all the exceptions.
We only catch requests and action errors so we only look for connection errors.
In this case we get a lot of connection errors and if we want to catch an error we can just skip to
the next iteration of the for loop so we'll say that.
However you can get really granular here by catching certain status codes and output them.
Now there is a lot of room to play with however in this case will be just straight forward.
So if a connection error occurs we'll just move on to the next iteration so we'll say pass or else.
So we have else print valid domain and then we have printed the domain your URL to check and that's
just about it.
So this is actually how you write a very simple subdomain discovery tool in a few lines in just a few
lines Python code.
Now let's actually put this in action.
So I've saved it going to open up a command prompt and then navigate to desktop and I'm simply going
to run it with Python so deep thought P Y and then the domain that I want to test for.
So Google doesn't mind if we actually look for a few subdomains.
OK.
Hit enter and as you can see the simplicity of it is just actually beautiful.
This this thing does its work just as intended.
So we already found two subdomains.
Now of course you can dramatically increase its speed by threading more paralyzing it.
You would work with the threading and queue modules here.
You could also have it take multiple arguments such as custom water lists.
You could have a display certain error codes and you could have it save the resource to file instead
of just throwing them in the output as it does here.
You could have it run recursively such as checking for subdomains of subdomains etc. and we might work
on such a tool in a more advanced Python for penetration testing course or glass until then I'd encourage
you to see how you can expand this tool yourself and also make sure to check out the resources for more
good stuff from the Python code.
Dot com blog.