TryHackMe - Subdomain Enumeration
TryHackMe - Subdomain Enumeration
Task 1 - Brief
What is a subdomain enumeration method beginning with B?
Brute Force
What is a subdomain enumeration method beginning with O?
OSINT
What is a subdomain enumeration method beginning with V?
Virtual Host
Task 2 - OSINT - SSL/TLS Certificates
What domain was logged on crt.sh at 2020-12-26?
visiting the site and entering tryhackme.com, on 2020-12-26 we see store.tryhackme.com
Task 3 - OSINT - Search Engines
What is the TryHackMe subdomain beginning with S discovered using the above Google search?
store.tryhackme.com
Task 4 - DNS Bruteforce
What is the first subdomain found with the dnsrecon tool?
api.acmeitsupport.thm
1
2
3
4
5
6
7
user@thm:~$ dnsrecon -t brt -d acmeitsupport.thm
[*] No file was specified with domains to check.
[*] Using file provided with tool: /usr/share/dnsrecon/namelist.txt
[*] A api.acmeitsupport.thm 10.10.10.10
[*] A www.acmeitsupport.thm 10.10.10.10
[+] 2 Record Found
user@thm:~$
Task 5 - OSINT - Sublist3r
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
user@thm:~$ ./sublist3r.py -d acmeitsupport.thm
____ _ _ _ _ _____
/ ___| _ _| |__ | (_)___| |_|___ / _ __
\___ \| | | | '_ \| | / __| __| |_ \| '__|
___) | |_| | |_) | | \__ \ |_ ___) | |
|____/ \__,_|_.__/|_|_|___/\__|____/|_|
# Coded By Ahmed Aboul-Ela - @aboul3la
[-] Enumerating subdomains now for acmeitsupport.thm
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[-] Searching now in Virustotal..
[-] Total Unique Subdomains Found: 2
web55.acmeitsupport.thm
www.acmeitsupport.thm
user@thm:~$
What is the first subdomain discovered by sublist3r?
web55.acmeitsupport.thm
Task 6 - Virtual Hosts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
❯ ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://MACHINE_IP -fs 2395
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://MACHINE_IP
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt
:: Header : Host: FUZZ.acmeitsupport.thm
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 2395
________________________________________________
api [Status: 200, Size: 31, Words: 4, Lines: 1, Duration: 63ms]
delta [Status: 200, Size: 51, Words: 7, Lines: 1, Duration: 61ms]
yellow [Status: 200, Size: 56, Words: 8, Lines: 1, Duration: 65ms]
:: Progress: [151265/151265] :: Job [1/1] :: 466 req/sec :: Duration: [0:04:48] :: Errors: 0 ::
What is the first subdomain discovered?
delta
What is the second subdomain discovered?
yellow
This post is licensed under CC BY 4.0 by the author.