Top 20 Subdomains Search Engines

By Kunal Patil, Senior Threat Hunter





Whats is Domain? 

An organization shares a common suffix as Domain names which is controlled by that Organization or individual.

What is Subdomains?

Basically Subdomains are subdivisions of Domain.

Why it is required?

Subdomains are second website, which have its own unique content and makes hosting manageable and easy to organize.
        Every second Organization Consists of various Subdomains as per their Requirements, I listed few Subdomains Search Engines, list is below : 

In this blog i will show one of my Favorite picks which gives better results for Enumeration rather than running different tools all Together.

Sublist3r

Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing and many more.

 To begin with the installation, sublist3r requires Python 2.7.x or 3.4.x needs to be installed.  

Steps to Install: 

First we need PIP for further installation, commands are below :
  • sudo apt-get install python-setuptools python-dev build-essential
  • sudo easy_install pip
  • sudo apt-get update

Now download the Python Sublist3r Repository from GITHUB, and change the current path to Sublist3r directory and hit below command:
  • sudo pip install -r requirements.txt
It will Install all the Required Dependencies for implementing Sublist3r, Now we have completely 
Installed Sublist3r on our machine, Start using it...


Usage     Short Form            Description 





-d          --domain                 Domain name to enumerate subdomains of

-b          --bruteforce             Enable the subbrute bruteforce module

-p          --ports                     Scan the found subdomains against specific tcp ports

-v          --verbose                 Enable the verbose mode and display results in realtime

-t           --threads                  Number of threads to use for subbrute bruteforce

-e          --engines                  Specify a comma-separated list of search engines

-o          --output                    Save the results to text file

-h          --help                       show the help message and exit



Examples : 


    

  •  python sublist3r.py -d google.com
    • 



    

  • python sublist3r.py -h
    • 






Final OUTPUT should be like this : 













we can Also Save OUTPUT using "">>"" operator.  eg: python sublist3r.py -d google.com >> /path/to/save/Output.txt





Please Share If you like



Thank You :-)


















































I am a security researcher where my expertize includes domains like incident response and investigation, Malware Analysis, Threat Hunting, deception Technology, Brand protection, SIEM configuration, Digital Forensics, Cyber Threat Intelligence, EDR, Network Security, Content Filtering, etc

While working I had completed my Masters(2021) in Information security where I published a thesis on “Malware Analysis using machine Learning Ensemble”

My goal is to share the knowledge with everyone with technologies, upcoming trends, various platforms and mainly Lock it down, protect it up, and block the hackers.


















Comments









  1. Unknown7 June 2019 at 10:26
    Nice one man!
    ReplyDelete
  2. latest-release14 August 2019 at 17:12
    Those are great tools. I did host 5 of them https://www.nmmapper.com/sys/tools/subdomainfinder/ including nmap's dns-brute
    ReplyDelete
  3. latest-release10 September 2019 at 09:14
    Some of this tools  I did host them online at https://www.nmmapper.com/sys/tools/subdomainfinder/
    ReplyDelete











Post a Comment



















Popular posts from this blog









RTR using Falcon Crowdstrike







By Kunal Patil, Senior Threat Hunter





















Image







Real Time Response Real Time Response is a powerful tool that gives security administrations the ability to remotely access systems for administration tasks, remediation actions or forensics collection, etc. without requiring physical access to the system. For more information on the CrowdStrike solution, see the additional resources and links below. In the Falcon UI, navigate to Activity > Detections.  Commonly, a new detection will be the event that triggers a need for remediation.Directly from a given detection, the “Connect to Host” button allows you to remotely connect and take action. You can also connect to a host from Hosts > Host Management. Once connected, you will be presented with a list of commands and capabilities available in Real Time Response. With the ability to run commands, executables and scripts, the possibilities are endless. A few examples are listed below.








Read more










Top Commands Mostly Used By System Administrator.







By Kunal Patil, Senior Threat Hunter





















Image







 Top Commands Mostly Used By System Administrator.   1) IPconfig    IPCONFIG   Simply entering ipconfig at the command line will return basic addressing information for your system, including the adapter name, IP address, subnet mask, and default gateway.   2) IPconfig /all    IPCONFIG/ALL   Shows all networking      information for the system, including host name, node type, adapter names,      MAC addresses, DHCP lease information, etc.   3) Ping    PING   Ping  command to verify that a host can be reached over the network. This command is useful for diagnosing host and network connectivity problems. The device sends a series of ICMP echo (ping) requests to a specified host and receives ICMP echo responses.   4) Ping "Website-name"    PING TO WEBSITE      This above command used to find the IP address associated with The Specific Website. eg: 10.24.126.25 is the IP address for Website Intranet.indusind.com   5) Tracert "IP address"    TRACE COMMAND    Tracert comm...








Read more










SECURITY OPERATION CENTRE







By Kunal Patil, Senior Threat Hunter





















Image







      What is SOC?                     Security operations centers  monitor and analyze activity on networks, servers, endpoints, databases, applications, websites, and other systems, looking for anomalous activity that could be indicative of a security incident or compromise. The SOC is responsible for ensuring that potential security incidents are correctly identified, analyzed, defended, investigated, and reported. SOC works with collaboration with People, Process and Technology.       SOC Architecture      PEOPLE:                    The best way to think of a SOC is as a centralized team of people who provide threat monitoring, investigation, and response.  Larger SOCs employ a three-level analyst structure for handling security alerts generated by a security system or SIEM.    Level 1  analysts are responsible for real-time monitoring of security alerts, doing tri...








Read more










Damn Vulnerable Web Application - Part 1







By Kunal Patil, Senior Threat Hunter





















Image







 The Damn Vulnerable Web Application (DVWA) provides a PHP/MySQL web application that is damn vulnerable whose goal of being an intentionally vulnerable system for practice/teaching purposes in regard to Information Security.There are many Methods for Installing DVWA on Platforms Like Windows and Linux, In this blog i will show the easiest Walk-through for Beginners to Learn and Exploit Web Application. So let us Start with Installation and Implementation of DVWA.   Step By Step Installation    1) Requirement :    Windows system for Managing VM  Virtual Box  ( Link ) or VMware  ( Link ) should be installed on system  Kali-ISO  ( Link )  DVWA ISO  ( Link )       2) Switch-ON Kali and DVWA virtual machines Both must be in HOST only Adapter (we can change using VM Network setting).      3) After the Installation of Kali and DVWA in VM, find the IP address of DWVA using the Command ifconfig and Check Connectivity between them using ping command.     4) Run Kali machine and DVWA ma...








Read more










Cyber Threat Intelligence 







By Kunal Patil, Senior Threat Hunter





















Image







  Gartner Definition:   Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.       To understand this term easily lets split the words and bring out meaning to it :   Cyber :  relating to or characteristic of the culture of computers, information technology, and virtual reality.   Threat :  thing likely to cause damage or danger.   Intelligence :  the ability to acquire and apply knowledge and skills.                  Cyber Threat intelligence helps Organisation to understands the risk of most common External threats. T hreat intelligence includes in-depth information about specific threats to help an organization protect itself from the types of attacks that could do them the most damage....








Read more










Collective Intelligence Framework v3 - Part 1







By Kunal Patil, Senior Threat Hunter





















Image







      Basic About CTI   Cyber Threat intelligence(CTI)  is a Technology which helps an Organization to collect and Analyze threat data received from multiple resources. Cyber threat intelligence is an automation process where it accumulate data from various external resources (such as FEEDS) and recognize the threats suitable for the Organization. By importing the Data from CTI, the next step is to exporting the CTI data into Existing Security systems.   Collective intelligence Framework is an underlying Structure of CTI which helps any organization to gather all Threat Data at one place.   In this blog we are discussing how to Install Collective Intelligence Framework v3 (Bearded Avenger)  into security structure.   Details Information About CIF you will found at : csirtgadgets    Basic Requirements for Bearded Avenger CIF v3 :   OS: Ubuntu 16 LTS,  x64  RAM: 16GB  Cores: 4 (As Sqlite, ElasticSearch, CIF-Router among other apps would be running on same instance)  HDD Capacity: 100...








Read more










Collective Intelligence Framework v3 - Part 2







By Kunal Patil, Senior Threat Hunter





















Image







     In Previous blog we learned how to setup CIFv3, in this section we will discuss how to integrate data and filter the Resulted Data by-passing different parameters to it.   We might have question that what happens exactly after hitting cif command or how cifv3 fetches feeds from external resources. well in this blog i will cover every details of CIFv3 but before that lets study few terminologies to understands the implementation of this Project.   CIFv3 uses few Terminologies  like :   1) TLP   TLP stands for Traffic Light Protocol originally created by UK government for the Purpose of sharing of sensitive data.  There are four colors in TLP (same like traffic lights) :    RED - Not for disclosure, restricted to participants only  AMBER - Limited disclosure, restricted within own organisation and clients or customers.  GREEN -   Limited disclosure, restricted to the community but not via public channels  WHITE -  Disclosure is not limited    2) Timestamps   CIF supports three T...








Read more










Security Architecture for Startup







By Kunal Patil, Senior Threat Hunter





















Image







                  Security Architecture is the design artifacts that describes how the security controls are positioned and how they relate to the overall systems architecture. These controls serve the Purpose to maintain the system's quality attributes such as confidentiality, integrity and availability.     Following is the 10 steps plan required to build Security Architecture For Startup :     Pick Your battle   Establish a security culture   Pick security platform   Upgrade your software   Physical security   Control the internal network   Secure coding   Protect devices against malware   Perform security audits   BYOD Policies   Pick Your Battle  You can't secure everything, Quantify the monetory damage, likelyhood and mitigation cost of each threat to prioritize time and resource. Below are the list of threats which can taken into consideration as per Goal of the Industry (Budget + Risks).      Es...








Read more










TrickBot Malware Family - A Deep Dive using Falcon Crowdstrike







By Kunal Patil, Senior Threat Hunter





















Image







Use Case  Falcon OverWatch has identified probable TrickBot  malware on host NAOUXXXX. A renamed copy of Vhd2disk was executed on the host, likely from a successful phish. This in turn wrote and executed a malicious file, likely TrickBot malware, and established persistence for it with a registry key. Introduction  Emotet Often referred to as a banking trojan or worm. It is a very advanced threat that is updated multiple times a day by the cybercrooks controlling it. Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Additionally, Emotet is a polymorphic banking Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities. TrickBot TrickBot is most commonly installed by the Emotet Trojan, which is spread throu...








Read more