When performing a black-box test, the client may not give us all of the subdomains of their organization. In this recipe, we will cover one of the few techniques that can be used to get a list of the subdomains of an organization.
Getting a list of subdomains
How to do it...
DNSdumpster: It is a free project by HackerTarget that lets us look up subdomains. It relies on https://scans.io/ for its results. It is pretty simple to use.
- We type the domain name we want and it will show us the results of all the subdomains it could find:
In the following screenshot, we can see the subdomains of the domain packtpub.com:
In the following recipe, we will look at Shodan, which is the most useful source for knowing about what devices...
