Enumerating subdomains

Every day, search engines such as Bing, Google, and Yahoo frequently learn and index new and existing websites to improve their search results. If you search for a company's website, you are likely to discover the main domain name, such as example.com. A lot of organizations create subdomains for various reasons, but as an aspiring penetration tester, discovering all the possible subdomains of a target organization can lead to sensitive locations and resources, such as login portals and sensitive corporate directories, which may contain confidential files and resources.

Working with DNSmap

DNSmap works a bit differently from the tools we looked at in the previous sections. DNSmap attempts to enumerate the subdomains of an organization's domain name by querying a built-in wordlist on Kali Linux. Once a subdomain has been found, DNSmap will also attempt to resolve the IP address automatically.

To get started using DNSmap, please use the following...