How to enumerate/filter a subset of domains containing wildcards? #647

vansh1 · 2022-09-22T21:18:50Z

vansh1
Sep 22, 2022

how to enumerate multi-subdomains in middle of domain like
like support.*.hackeron.com

You have a couple of options to achieve this:

You do passive searching for all the subdomains, and then filter the results manually using grep (or using the freshly implemented #575 feature, which is available on the dev branch)

subfinder -d hackerone.com -match "support*.hackerone.com"

You create generate the subdomains using a wordlist and then use dnsx to validate the results.

for word in $(cat wordlist.txt); do echo "support.$word.hackerone.com" >> generated.txt; done
cat generated.txt | dnsx

There is also a feature request in dnsx. You can subscribe to it in order receive a notification when it gets implemented.

forgedhallpass · 2022-09-23T13:08:45Z

You have a couple of options to achieve this:

You do passive searching for all the subdomains, and then filter the results manually using grep (or using the freshly implemented Filter the output based on a given scope #575 feature, which is available on the dev branch)

subfinder -d hackerone.com -match "support*.hackerone.com"

You create generate the subdomains using a wordlist and then use dnsx to validate the results.

for word in $(cat wordlist.txt); do echo "support.$word.hackerone.com" >> generated.txt; done
cat generated.txt | dnsx

There is also a feature request in dnsx. You can subscribe to it in order receive a notification when it gets implemented.

0 replies