-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
Add a command that looks up subdomains for a given domain. We can accomplish this in a few ways:
- Simple brute-force search, given a wordlist of popular subdomains try to lookup a DNS record for the prefix+ domain. If found, the subdomain is valid and should be returned.
- Lookup certificate transparency logs for the given domain. These logs will record certificates issued for a domain and potentially subdomains, giving more information for valid subdomains for the given domain.
- Try a zone transfer to get a complete copy of the DNS entries for the domain. This is unlikely to work as most DNS servers will reject zone transfer attempts but it could be worth a shot.
Metadata
Metadata
Assignees
Labels
No labels