Subdomain Discovery
Finding subdomains is a method of reconnaissance.
Automation
Reference: https://medium.com/@DrakenKun/how-to-find-subdomain-takeover-using-httpx-dig-5c2351d380b4
Subfinder
To set API keys, add them to $HOME/.config/subfinder/provider-config.yaml. See https://docs.projectdiscovery.io/tools/subfinder/install#post-install-configuration for details.
# -all: Use all sources for enumeration
# -cs: Include all sources in the output
subfinder -d example.com -all -cs > tmp. ; cat tmp. | cut -d "," -f 1 > domains. ; rm tmp.
BBOT
bbot -t example.com -f subdomain-enum
# After enumerating, see the result file at ~/.bbot/scans/xxxx_xxxx/subdomains.
Google Dorks
Use site: parameter on Google search.
Online Tools
Subdomain Takeover
After enumerating, it’s worth to check the Subdomain Takever.
Subdomain Takeover
Subdomain Takeover is a malicious activity that the victim’s subdomain allows attackers to control and impersonate.
- [10-Test_for_Subdomain_Takeover](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover)
- [how-to-find-subdomain-takeover](https://medium.com/@DrakenKun/how-to-find-subdomain-takeover-using-httpx-dig-5c2351d380b4)
Automation
First we need to enumerate subdomains. See Subdomain Discovery for doing that. Then we can httpx for checking HTTP response status for each subdomain.
httpx
https://github.com/projectdiscovery/httpx
# -title: Display page title
# -wc: Display response body word count
# -sc: Display response status-code
# -cl: Display response content-length
# -ct: Display response content-type
# -location: Display response redirect location
# -web-server: Display server name
# -asn: Display host ASN information
# -o: Output
cat domains. | httpx -title -wc -sc -cl -ct -location -web-server -asn -o alive-subdomains.
# Resume Scan (-resume)
# You can resume the scan using `resume.cfg`.
cat domains. | httpx -title -wc -sc -cl -ct -location -web-server -asn -o alive-subdomains. -resume resume.cfg
Can I Take Over XYZ?
See https://github.com/EdOverflow/can-i-take-over-xyz to check if the provider allows us to register subdomains.
CNAME Subdomain Takeover
1. Identify Misconfigurations for Subdomains
Check DNS records for identifying what’s on the destination of the subdomain.
If the HEADER status is NXDOMAIN error in the result, subdomain takeover might be possible.
Also we can try to access them with web browser or command-line:
# -L: Follow redirect
# -v: Verbose mode
curl -Lv app.example.com
curl -v cloud.example.com
curl -v mail.example.com
2. Spoof with the Subdomain
If a certain subdomain can be accessible but the error page of the specific provider (e.g. GitHub, Google Cloud, Wix, etc.) appeared, it means that the subdomain of the settings in the service provider was removed but the DNS record (e.g. A, CNAME) remains yet.
In short, attackers can spoof as a legitimate site by claiming this subdomain in the provider.
Here’s an abstract example:
- Login the target provider.
- Create a malicious website.
- Add the target subdomain (e.g. app.example.com) as custom domain in the setting page.
- If users visit app.example.com, they have now visited a malicious website created by an attacker.
NS Subdomain Takeover
It’s more dangerous If NS record is vulnerable because if the nameserver is taken over, an attacker can take full control of victim’s domains.
To gather NS records for the target domain, use dig command.
Next, check if the gathered domains can be purchased with domain name registrar like GoDaddy, NameCheap.
For example, search [abcde.org](http://abcde.org) in the domain search page of NameCheap. If this domain can be purchased, attackers can buy this domain then take control the name resolution of a victim by creating the custom nameserver which pointed to this domain.