-
Subwiz https://github.com/hadriansecurity/subwiz can predict possible subdomains via a LLM. Subfinder https://github.com/projectdiscovery/subfinder tries to get subdomains via passive information gathering. Gobuster Gobuster can brute-force subdomains.
-
Enumeration Mandatory Try to perform a zone transfer:dig axfr @10.10.11.166 trick.htb
-
Manual enumeration Subdomain enumeration Put usual domain names (Seclists!) and iterate them with the bash $ for ip in $(cat list.txt); do host $ip.domain.com; done IP enumeration Enumerate an IP range to find domains $ for ip in $(seq 50 100); do host 38.100.193.$ip; done | grep -v "not found" Zone transfer Perform a DNS zone…