Subdomain takeover was once a very popular vulnerability. It’s still constantly being discovered. Of course, there are so many hackers running automated code that it’s hard to actually find it. but you’ll find it with lucky. and from the corporate security point of view, you have to check it out. so i share it.
So I just use it for reference in the subdomain. It’s… it’s almost never there on popular target, and it’s often duplicated if it’s vulnerable.
TLDR
|
|
Replace {target_domain} to your target! (It’s convenient to be an editor like IDE or geany)
Pre-install
Amass
Install Amass
|
|
https://github.com/OWASP/Amass/blob/master/doc/install.md https://www.hahwul.com/2019/09/owasp-amass-dns-enumnetwork-mapping.html
running command: $ amass enum -d [target domain]
Subjack
Install subjack on goget!
|
|
set alias
|
|
running command: subjack -w target.txt -c config_file
I’ve added some more content after watching this(https://twitter.com/C5pider/status/1185672360717893633). thank you, guys!
Write oneline command.
write result file on amass
|
|
read subdomain list(-w options) on subjack
|
|
PPAP
|
|
Conclusion
The majority of bounty hunters are turning all the domains in the Bergbounty scope. It’s a perfect time fight.
https://github.com/arkadiyt/bounty-targets-data
and … If you use FDSN(https://opendata.rapid7.com/sonar.fdns_v2/), you can get a lot of domains.