[MUSIC PLAYING]
Subdomain enumeration with Sublist3r.
In this video, we're going to be taking a look at how
to passively enumerate subdomains
for a specific domain through the use of a really
cool open source tool called Sublist3r.
So again, I'm going to be performing this on my Kali
Linux VM, and we're going to be, again,
exploring or taking a look at the same sites
that we've been using thus far.
So again, the important thing to note here
is we're not performing subdomain brute forcing.
So we're not actively engaging with the target.
This is not active information gathering.
We're essentially using-- we're using
publicly available sources of information, like search
engines, like Google, Bing, Yahoo, et cetera,
to find subdomains that might have been indexed
by these search engines.
And Sublist3r is a really, really useful tool
that will essentially allow us to do this as efficiently as
possible.
So I'm going to switch over to my Kali Linux VM.
All right, so I'm back on my Kali Linux VM,
and I'm currently on the Sublist3r GitHub repository.
By the way, all credits go to the author
of this really cool tool, Ahmed Aboul-Ela, a really fantastic
tool that I've used for many, many years.
And if you want to learn more about it,
I recommend taking a look at the GitHub repository.
So as you can see right over here,
Sublist3r is a Python tool that's
designed to enumerate subdomains of websites using OSINT, which
is Open Source INTelligence.
That essentially means information
that is publicly available, which
falls in line with passive information gathering.
It helps penetration testers and bug hunters collect and gather
subdomains for the domain they are targeting.
Sublist3r enumerates subdomains using
many search engines, such as Google, Yahoo, Bing, Baidu,
and Ask.
Sublist3r also enumerates subdomains
using Netcraft, VirusTotal, ThreatCrowd, DNSdumpster, which
we've used, and ReverseDNS.
And subbrute, which was another script,
was integrated with Sublist3r to increase
the possibility of finding more subdomains using brute force.
So this tool also supports brute force,
and we will not be utilizing that functionality because that
essentially falls into the domain of active information
gathering because, at that point,
we'll be actively engaging with the target
system or, in this case, the target domain.
So Sublist3r is already part of the Kali Linux repositories,
which means you can install it by typing
in the following command.
It doesn't come preinstalled, but it's
available within the repos.
So if I type in sudo app-get install and sublist3r,
you can see I already have it installed.
And the actual syntax or the usage instructions
are fairly easy to understand.
You can see that you need to specify
the domain with the -d argument or the -d option.
You also have the long form if you want to specify that.
And then, of course, in our case,
we're going to be specifying the search engines.
So you might be asking yourself, well, how does this work?
How does Sublist3r find subdomains
for a particular domain that you're targeting?
And I want to firstly point out that you're not
going to get 100% success because it's
going to essentially search or perform searches
on all of these search engines to try and see if there is
a subdomain that might have been indexed previously
that could possibly be hidden now, or might not be active
but it's still accessible through the internet.
And this is something that you will
be able to do in the next video when
we'll be exploring Google Docs.
So this is essentially automating that process,
but I wanted to cover it before we actually get to that point.
So now that we have it installed,
you can see that the search engines we can specify
are Google, Baidu, et cetera.
So in this case, let's try it out with Google and Yahoo
because they are the ones--
these are the sites or search engines that index the best.
So we can say, Sublist3r.
Domain is hackersploit.org.
And in this case, the search engine
is going to be Google and Yahoo.
Now, one thing to note, this tool makes a lot of requests
to Google via your IP address, and Google
has a rate-limiting functionality
that will essentially limit the amount of requests
that you can make.
So that's why in the previous videos you saw that,
whenever I open up google.com, it prompted me to essentially
enter in a CAPTCHA or to verify myself because I passed
the threshold of what Google considers legitimate traffic
that's being essentially--
being performed or facilitated by a standard user.
With a tool like this, we're sending a ton of requests,
so do be cognizant of that.
So I'll hit Enter, and we're going to give this
a couple of seconds.
So you can see that Google is now blocking our requests.
So in order to bypass this, I am going to switch to a VPN.
So I have a third-party VPN service that
will allow me to bypass this.
In your case, you will not need to go
through this particular process, but we can easily
bypass it by saying, we want to use Yahoo, for example.
So we'll just run it with Yahoo before switching to my VPN.
As I said, you don't need to do this
because this is going to be your first time running it.
Again, if you take a look at the usage instructions,
it should actually highlight that.
And, of course, you have the ability
to output your results into a text file, which is something
that I recommend that you do whenever you're
performing a penetration test.
So let me just activate my VPN, and then we
can try this out again.
All right, so I've enabled my VPN, which
means I'm now in another location,
but you didn't hear that from me.
So we can perform--
we can run Sublist3r again now, and hopefully, Google
will not block our requests.
So there we are.
It looks like it's working now.
So that's one way to bypass that.
You can easily get a free access to a free VPN for the purposes
of performing enumeration.
So this will take a couple of seconds, and in this case,
you can see we weren't able to find any subdomains.
So we can try and add other search engines
into our particular search here.
So let's see if we can find the actual search engines that we
can use here because I don't think they are highlighted
explicitly.
There we are.
So in this case, it looks like we don't need to specify.
We can simply get rid of the engine option here,
and this will run the search on all engines.
So there we are.
Looks like VirusTotal is probably blocking our requests.
So that's fine.
We should be able to find subdomains for hackersploit.org
because I have set up others.
And, of course, we should be able to find the forum
subdomain.
So again, we'll just let this complete.
There might be an issue where you
would need to specify the actual domain as is,
but this should work.
So I'm just going to let this complete because it's actually
searching in all--
it's going to be searching with all search engines.
As you can see in this case, that
did not look like it worked.
So if we say www.hackersploit.org,
will that change anything?
Probably not.
So for some reason, it looks like we
aren't getting any results.
So what we can do is we can limit this
to maybe a site like DNSdumpster,
and let's see whether that produces any results.
As you can see, that doesn't.
We were able to identify the subdomain on Netcraft,
so let's try and do that now.
So I'm going to specify the search engine as Netcraft.
Is it still not giving us any results?
That's perfectly fine.
We can try this maybe on zonetransfer.me.
And let's see whether we get any results.
If not, it's probably my VPN again.
I'll probably need to switch my VPN,
and we'll see whether that works again because this can
be quite tedious of a process.
But that's why we'll have the next video, where we'll
be taking a look at how to essentially utilize Google Docs
or Google hacking to identify information like this,
through publicly available information.
So let's see whether we get any results for zonetransfer.me.
I really doubt it because we weren't
able to enumerate or identify any subdomains on DNSdumpster.
So in this case, you can see we only
found the actual main domain, which is www.zonetransfer.me,
which is really weird because I do
know that I had various subdomains
for hackersploit.org.
What we can do is try and do this for maybe a site
like ine.com, and let's see whether we
are able to identify subdomains like this.
If not, as I said, it might be an issue
with my DNS server and the fact that most of these sites
are now blocking my requests.
So we can also limit the amount of threads
we are using to essentially limit the amount of requests
we are sending, using the -t option, which you saw
me use previously, but that's really
for the brute force attack.
And let's see whether we get any subdomains for ine.com,
because I know that this tool does indeed work,
just that in certain cases, some of these search engines
or sites might be blocking your requests.
So do keep that in mind.
There we are.
So for INE, you can see we get all of these subdomains, which
you might not have known about.
So some of these--
I don't know whether I should be showing you,
but again, there really isn't any harm in this
because these are all publicly available subdomains.
You just need to know how to search for them.
So as you can see here, we have all
of these subdomains, which it's enumerated successfully
for ine.com.
And that's essentially it with regards to utilizing Sublist3r.
As I said, in certain cases, it might not
work because you might have exceeded
the amount of requests you're sending, but there you go.
So that is how to utilize Sublist3r
for subdomain enumeration, more specifically
passive subdomain enumeration.
And this is going to conclude the practical demonstration
side of this video.
All right, in the next video, we're
going to be taking a look at how to utilize Google Docs
or Google dorking to essentially identify information
that is pertinent to a target.
In this case, we're going to be, again,
sticking to domain names.
But we're going to be taking a look at how to really use
Google to find what you're looking for,
whether it be specific subdomains, specific sites,
or specific links, specific files associated
with a domain, et cetera, et cetera.
So I'll be seeing you in the next video.