> For the complete documentation index, see [llms.txt](https://yigitsengezer.gitbook.io/siber-guvenlik-notlari/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yigitsengezer.gitbook.io/siber-guvenlik-notlari/information-gathering/subdomain-enumeration.md).

# Subdomain Enumeration

### ASN Lookup

* <https://bgp.he.net/>
* <https://hackertarget.com/as-ip-lookup/>

### Related Domains

* Reverse whois: <https://viewdns.info/>
* Builtwith: <https://pro.builtwith.com/>
* [CRT.sh](https://crt.sh/)

### DNS Records

* [SecurityTrails](https://securitytrails.com/app)
* [DNSDumpster](https://dnsdumpster.com/)

### Subfinder

Pasif tarama yaparak subdomainleri listeler.

* Bevigil: <https://bevigil.com/osint/api-keys>
* BinaryEdge: <https://app.binaryedge.io/account/api>
* BufferOver: <https://tls.bufferover.run/>
* Builtwith: <https://api.builtwith.com/>
* Censys: <https://search.censys.io/account/api>
* Certspotter: <https://sslmate.com/account/api_keys>
* Chaos: <https://cloud.projectdiscovery.io/>
* Fofa: <https://en.fofa.info/userInfo>
* Hunter: <https://hunter.io/api-keys>
* intelx: <https://intelx.io/account?tab=developer>
* Leakix: <https://leakix.net/settings/api>
* Netlas: <https://app.netlas.io/profile/>
* SecurityTrails: <https://securitytrails.com/app/account/credentials>
* Shodan: <https://account.shodan.io/>
* Virustotal: [https://www.virustotal.com/gui/user/](https://www.virustotal.com/gui/user/denemeasd/apikey)
* Zoomeye: <https://www.zoomeye.hk/profile>

```bash
# FREE bevigil builtwith fofa securitytrails shodan zoomeye
code -r /root/.config/subfinder/provider-config.yaml

cat domains.txt | subfinder -silent -all | anew subdomains.txt
```

### DNS Bruteforce

```bash
echo 1.1.1.1 > resolver.txt
shuffledns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r resolver.txt -mode bruteforce -silent | anew live.txt
```

### Live Subdomains

```bash
cat subdomains.txt | dnsx -silent -retry 5 | anew live.txt
```

### Live Websites

```bash
cat live.txt | httpx -silent -nc -sc -cl -fr -title -server -td -cdn -ip | anew web.txt

cat live.txt | httpx -silent -csv -o web.csv -ports 80,443,3387,5985,8005,8009,8080,8081,8090,8180,8443

cat httpx.txt | tr "[]" "~" | cut -d "~" -f1
cat httpx.txt | tr "[]" "~" | sort -t "~" -k1 -n
```

### Screenshot

```bash
gowitness report server -q --host 0.0.0.0
gowitness scan file --write-db -f live.txt --no-http -p 443 -t 20 -T 30

gowitness report generate
unzip gowitness-report.zip -d gowitness

http://localhost:7171
```

### Assetfinder

Bu tool verilen domainle bağlantı olabilecek diğer domain ve subdomainleri bulur.

```bash
assetfinder example.com
```

### VHOST Enumeration

```bash
ffuf -u http://example.com/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H 'HOST: FUZZ.example.com' -fs 15949
```

### URL Enumeration

```bash
cat example_live.txt | (gau || hakrawler || waybackurls || katana) | anew example_urls.txt

cat example_urls.txt | uro | gf xss | grep '?' | qsreplace '"><img src=x onerror=alert(1)>' | httpx -sc -mr '<img src=x'
```

### Web Crawling

```bash
katana -u 'https://example.com' -jc -aff -iqp -s breadth-first -d 5 -hl -nos -o example.txt

katana -u 'https://example.com' -aff -j | jq -r '.request.raw'
```

### Bug Bounty Target Toplama

```bash
# Hackerone
curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/hackerone_data.json | jq -r '.[].targets.in_scope[] | [.asset_identifier, .asset_type] | @tsv' > hackerone.txt

# Bugcrowd
curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/bugcrowd_data.json | jq -r '.[].targets.in_scope[] | [.target, .type] | @tsv' > bugcrowd.txt

# Intigriti
curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/intigriti_data.json | jq -r '.[].targets.in_scope[] | [.endpoint, .type] | @tsv' > intigriti.txt

# YesWeHack
curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/yeswehack_data.json | jq -r '.[].targets.in_scope[] | [.target, .type] | @tsv' > yeswehack.txt

# All Subdomains
wget https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/refs/heads/main/data/domains.txt

# All Wildcards
wget https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/refs/heads/main/data/wildcards.txt
```