> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-web/sub-domain-enumeration.md).

# Sub Domain Enumeration

## Google Dorking

Google dorks can be used to enumerate host subdomains. For example searching for Microsoft.com subdomains we can use the minus - symbol to tell Google to remove URL results for particular strings.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FrUWUyQKHRtRnyvknWjSR%2Fimage.png?alt=media\&token=64cb86a2-dedf-4977-8a32-2573cacf18f8)

Every time a sub domain is found it can then be excluded from the next search

```
microsoft.com -www -docs -infrastructuremap
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FMhpwIdgt6o1a2z4EVkuO%2Fimage.png?alt=media\&token=aa54fd80-2316-41ca-a7c2-bffa9962e24d)

## Tools

### Amass

```bash
amass enum -d <domain>
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FNQBIHVghp4ihEfeyHr08%2Fimage.png?alt=media\&token=c6511f28-26b3-4ac4-b157-7db9d7bdeb70)

### DNSRecon

```bash
# Quick brute force
dnsrecon -t brt -v -d <Domain>

# With Wordlist
dnsrecon -t brt -D <Wordlist> -v -d <Domain>
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F1BA8mHwVZpR69J1VrIcJ%2Fimage.png?alt=media\&token=96126028-6c79-482a-8b1d-0115e5d9a735)

### Sublist3r

```bash
# Default Search
sublist3r -d <Domain> -v

# With brute force
```

### Wfuzz

```
wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://love.htb" -H "Host: FUZZ.love.htb" --hl 125
```

## Web Tools

### Cert.sh

{% embed url="<https://crt.sh>" %}

Searching a domain name in Cert.sh can help identify when SSL Certificates have been issued to a particular domain and subdomains.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FJM6JWb4uYgrjr1TZzF1m%2Fimage.png?alt=media\&token=b36e4ede-fa03-4c34-a808-23f1a37b729e)

### DNSdumpster

[DNSdumpster](https://dnsdumpster.com) is a great tool for DNS and host enumeration. We even get a nice downloadable graph and can even export discovered hosts directly to `.xlsx`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F7JRCJYacnBnRroe0xcRE%2Fimage.png?alt=media\&token=05a652f3-c2b0-4398-892b-d077a4bc5247)

### VirusTotal

VirusTotal can be used to look up sub domains of a host: <https://www.virustotal.com/gui/home/search>

```
https://www.virustotal.com/gui/domain/<Domain>/relations
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fw6yoJjrOfUwN02im81sU%2Fimage.png?alt=media\&token=27896113-0f26-455b-9095-69c48b6e0266)

## Virtual Hosts

Some subdomains aren't always hosted in publicly accessible DNS results, such as development versions of a web application or administration portals.

Web servers can host multiple websites under the same IP. The web server is able to differentiate between requests by the value in the **Host** header of a request. It is possible to take advantage of this by fuzzing the host header for discovery.

### Fuff

```bash
ffuf -w <Wordlist> -H "Host: FUZZ.acmeitsupport.thm" -u <IP>
```