So far, we've been gathering very useful information about the target, and we see that the target
is always on in the form of target dot com, such as Google dot com.
This name right here, such as Google dot com is known as a domain.
So this is the domain name.
This is what we put in the address bar to access the target Web site.
A lot of Web sites also have subdomains.
SubDomains are the names that you see before the domain name like this.
So in this example, we have subdomains, dot target, dot com, and a real life example would be mail,
dot, Google, dot com.
So in this case, the subdomain is subdomain.
And obviously in the Google example, the subdomain is mail and then the domain name is Google dot com.
So we know if we go to Google dot com, we're going to get the famous search engine that allows us to
search for things on the Internet.
But if we go to mail dot Google dot com, we're going to get a completely different Web application
that can be used to send and receive emails.
Therefore, it's as if we're getting completely different websites.
But we're still targeting the same domain name, which is Google dot com.
Therefore, if your target is Google dot com or target dot com, it is very important to discover all
of the subdomains on it because these subdomains can give us a lot of other information.
We can discover sensitive data.
We can discover management pages like the pages that the admin or members of the website used to access
certain functionality.
We can access completely different web applications.
We can even access beta version of the Web application or parts of the Web application that is still
under development.
These parts that are under development or the beta versions are really good for hackers because there
is a high chance of finding bugs because these parts of the Web application haven't been tested really
well or have experimental features and therefore there is a high chance of them containing bugs.
Therefore, there is a higher chance of finding weaknesses and exploited them to gain access to the
subdomain and then hopefully from there get access to the server or somehow escalate our privileges
to fully control the target website or the target web server.
Now, discovering subdomains is really, really easy and there is a lot of tools out there that can
be used to do that.
I'm going to use a tool called Knokke.
It's already installed in the custom Kalik that is made for this course.
If you don't have the custom color, you're going to have to download it and install it manually.
I'll include its download link in the resources of the lecture.
But using this tool is very, very simple.
You're simply going to have to type the name of the tool, which is not PCI, followed by the Target
website.
And in our case, let's just do it to Google dot com.
So very, very simple.
The program name followed by the target.
I'm going to hit Enter and you'll notice as soon as I launched the tool.
It's already starting to discover subdomains in here.
So I'm going to cancel this because this will keep going.
So I press control.
See, and if we scroll up, you can see we already have a lot of useful results.
So we have about dot Google dot com.
We've got this page that has given for four.
We've got accounts that Google dot com.
We got admin dot, Google dot com.
If we scroll down even more, we can see we have apps and if you keep it going, you're going to get
access to their API subdomain and so on.
So like I said, all of this increases our attack surface because we can target any of the subdomains
to gain access and try to discover sensitive files, discover the vulnerabilities that you're going
to learn later on in the course and try to exploit them to gain access to the target web server.
So obviously, the more Web applications that you can test, the bigger the attack surface and the higher
the chances of you discovering a vulnerability and hopefully achieving your goal and gaining access
to the target server.