The previous section covered how we could find subdomains using the publicly available Google search engine. While this is great, we should never assume that all subdomains can be found through such a method. The next few sections will cover finding subdomains using active discovery methods.
Enumerating DNS using the host command
Getting ready
To prepare for working with the host command, all you need is to open a Terminal from your Kali Linux distribution.
The host command is a standard command for Unix, Linux, and macOS systems.
How to do it...
Working with host command:
- DNS servers are address books; for this...