‫Now, once we get the authoritative DNS server address by using who is, we can identify any additional
‫hosts in the domain such as FTP server, mail server and so on.
‫If there are any other services in this domain, we can also extract information from them.
‫Now, another way to discover subdomains and the host is to query search engines.
‫And then you can compare the results.
‫OK, so here you might be confused about Hosten subdomains, so let me give you a quick explanation.
‫If you think of the address, extant example, dotcom, now ex is the subdomain of example dotcom.
‫And exact example, Dotcom can be a host if it is connected to an IP address and resolves to a computer
‫when one goes to exact example, dotcom.
‫Cool.
‫So anyway, there are multiple ways to extract additional Hosten subdomain information, so that means
‫there's lots of tools out there for us to use on this purpose.
‫And I'm going to use two tools that are already present in Colly fears.
‫And the Harvester Affairs is a really cool tool.
‫Besides that, it uses brute force methods to get subdomains.
‫Also, after it finds a valid host, then it performs a reverse lookup to uncover additional hosts.
‫And here are the options for fears.
‫OK, so first we're going to run a basic scan so type fears dash DNS Google dot com dash thread's 10
‫dash file bagrut slash desktop slash Google info, dot text and hit enter.
‫So the DNS parameter specifies the domain that you want to scan.
‫So in our example, it is Google dotcom.
‫By default, fears runs in a single thread mode.
‫So because of this.
‫I can add the threads parameter to increase the speed.
‫So that makes the skin run faster and then the final parameter helps us to save the results to a file.
‫Now, while scanning the hosts or subdomains.
‫What happens in the background so fierce first tries to find the DNS servers for the target domain.
‫The next, as I'm showing you on the screen, it attempts to do a zone transfer.
‫Now, at this point, if a zone transfer is successful, four years will stop running.
‫And then you can take that information that you got from the zone transfer.
‫Now, if zone transfer fails, as it has in our scan, it checks if wild card DNS is enabled.
‫And then he performs a brute force against the domain using its built in wordlist.
‫OK, so now the scan is complete.
‫And as you can see, once a scan is finished, the found subdomains and discovered subnets are listed.
‫We can also view and save the file, but the content is not that different, in fact, is not different
‫at all from the output on our screen, just makes it convenient.
‫And by default, Fears uses its own built in wordlist.
‫But it also provides the ability to use a custom word list that you can build and sometimes different
‫word lists can uncover new subdomains.
‫So the second tool is the harvester.
‫It is another subdomains scanner and it gathers public information such as employee names, email,
‫subdomains, banners and other similar information.
‫For now, we're just going to deal with subdomains and host.
‫And type the harvester.
‫And you'll see options.
‫Now, it's quite easy to use this tool, so let's just run it quickly.
‫Type the harvester dash d and the domain that you want to search, so in my case, of course, it's
‫Google dot com.
‫Now, it might be strange because I will be using Bing to search for Google dotcom, but by using the
‫B parameter, you can provide a data source L parameter limit the search output.
‫So the Harvester will analyze the first 500 search results of Bing about Google dot com.
‫And finally, the F parameter helps us to save the result to a file.
‫OK, so hit, Ettus, Run.
‫And first, the searches conducted.
‫Then it will analyze a result.
‫OK, so here's what we expected to see.
‫So now.
‫Go to the saved file directory.
‫Going to go to the desktop and here's a file, so let's have a look.
‫So it's not very different from the output that's on the screen.
‫At least we can have smaller graphics.
‫Great, so you can run these tools or some other ones if you wish for your target.
‫You can go ahead and practice at.