Foundational Reconnaissance Scanning and Enumeration Privilege Escalation Defense Evasion Attacking Services Attacking Active Directory Toolkit

Pentesting Foundational Reconnaissance Scanning and Enumeration Privilege Escalation Defense Evasion Attacking Services Attacking Active Directory Toolkit

📝Home
⚒️PENTESTING
👽MALWARE ANALYSIS
🏹THREAT HUNTING
- Foundational
  - ATT&CK Framework
  - CIA Triad
- APTs
🐍PROGRAMMING & SCRIPTING
🕵️DIGITAL FORENSICS
- Anti-Forensic Techniques
- 🪟Windows Security Internals
  - Windows Security Internals
    Kernel
    Security Reference Monitor (SRM)
    Object Manager
    System Calls
    NTSTATUS Codes
    Object Handles
    Query and Set Information System Calls
    The I/O Manager & The Process and Thread Manager
    The Memory Manager
    The Configuration Manager
💼GRC (CISSP Notes)
📦Networking
- Foundational
- Wireless Technologies

Powered by GitBook

On this page

Sublist3r
Certificate Search
OWASP Amass
DNS Bruteforce

⚒️PENTESTING

Reconnaissance

Hunting Subdomains

PreviousDiscovering Email Addresses NextScanning and Enumeration

Last updated 11 months ago

Sublist3r

Install on kali using apt install sublist3r

Run a search using the syntax - sublist3r -d domain

Certificate Search

Certificate Transparency (CT) logs
- Publicly accessible logs of every SSL/TLS certificate created for a domain name
- Purpose is to stop malicious and accidentally made certificates from being used
Uses certificate fingerprinting
Searchable databases of certificates
- crt.sh
- transparency report

OWASP Amass

OWASP Amass

DNS Bruteforce

Bruteforce DNS enumeration is the method of trying different subdomains from a list of commonly used subdomains
dnsrecon -t brt -d TARGET_SITE