Hacking Domained - Multi Tool Subdomain Enumeration

[Koc]

A domain name enumeration tool
The tools contained in domained requires Kali Linux (preferred) or Debian 7+ and Recon-ng
domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output)

Initial Install:

• domained tools: python3 domained.py --install
• Python required modules: sudo pip install -r ./ext/requirements.txt

Other Dependencies:

• ldnslibrary for DNS programming:
  • sudo apt-get install libldns-dev -y
• GoProgramming Language:
  • sudo apt-get install golang

NOTE: This is an active recon – only perform on applications that you have permission to test against.

Tools leveraged:

Subdomain Enumeraton Tools:

1. Sublist3r by Ahmed Aboul-Ela
2. enumall by Jason Haddix
3. Knock by Gianni Amato
4. Subbrute by TheRook
5. massdns by B. Blechschmidt
6. Recon-ng by Tim Tomes (LaNMaSteR53)
7. Amass by Jeff Foley (caffix)
8. SubFinder by by Ice3man543

Reporting + Wordlists:

• EyeWitness by ChrisTruncer
• SecList (DNS Recon List) by Daniel Miessler
• LevelUp All.txt Subdomain List by Jason Haddix

Usage:

First Step:

Download