Subdomain takeover was once a very popular vulnerability. It’s still constantly being discovered. Of course, there are so many hackers running automated code that it’s hard to actually find it. but you’ll find it with lucky. and from the corporate security point of view, you have to check it out. so i share it.

So I just use it for reference in the subdomain. It’s… it’s almost never there on popular target, and it’s often duplicated if it’s vulnerable.

TLDR

1
2

amass enum -norecursive -noalts -d {target_domain} > {target_domain}.txt ; subjack -w {target_domain}.txt -t 100 -timeout 30 -ssl -c ~/subjack/fingerprints.json -v 3

Replace {target_domain} to your target! (It’s convenient to be an editor like IDE or geany)

Pre-install

Amass

Install Amass

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

on Mac
brew tap caffix/amass; brew install amass

or(on ubuntu with apt)

apt-get install amass

or(on docker)

docker build -t amass https://github.com/OWASP/Amass.git
docker run -v ~/amass:/amass/ amass enum --list

or(with snapcraft)
snap install amass

https://github.com/OWASP/Amass/blob/master/doc/install.md https://www.hahwul.com/2019/09/owasp-amass-dns-enumnetwork-mapping.html

running command: $ amass enum -d [target domain]

Subjack

Install subjack on goget!

1
2

go get github.com/haccer/subjack

set alias

1
2

alias subjack='~/go/bin/subjack'

running command: subjack -w target.txt -c config_file

I’ve added some more content after watching this(https://twitter.com/C5pider/status/1185672360717893633). thank you, guys!

Write oneline command.

write result file on amass

1
2

amass enum -norecursive -noalts -d {target_domain} > {target_domain}.txt

read subdomain list(-w options) on subjack

1
2

subjack -w {target_domain}.txt -t 100 -timeout 30 -ssl -c ~/subjack/fingerprints.json -v 3

PPAP

1
2

amass enum -norecursive -noalts -d {target_domain} > {target_domain}.txt ; subjack -w {target_domain}.txt -t 100 -timeout 30 -ssl -c ~/subjack/fingerprints.json -v 3

Conclusion

The majority of bounty hunters are turning all the domains in the Bergbounty scope. It’s a perfect time fight.

https://github.com/arkadiyt/bounty-targets-data

and … If you use FDSN(https://opendata.rapid7.com/sonar.fdns_v2/), you can get a lot of domains.