How To Find Sub-domains Using subbrute Tool

Hi All, In this article we will see how we can easily find sub-domains of target domain.
Generally hackers use this tool in various bug bounties where they try to find sub-domain of given target domain in order to find bug.

Before going in deep lets first understand what subdomain is all about.

What is a Subdomain ?

Imagesource

Subdomain is the sub division of a domain which is used to separate different areas of your website , most of the websites uses different subdomain to change language for the users respected with the language

If a site has a feature of different languages then the users belonging to English language are directed to English pages and served with the service , same thing happens with the other language and countries.

Example:-blog.google.com, groups.google.com and sites.google.com

Where
blog=blogging
groups= for google groups
sites= for google site

NOTE:-
Subdomain is also called third level domain. They are same like the folders in your root directory but different URL to access.

Example:- www.website.com

Subdomain:-

1) services.website.com
2) blog.website.com

.com is the first level domain, website is the second level domain and blog,services are the third level domain

So lets start how to find different site domains:

There are multiple tools and google search engine techniques to find sub-domains which are:-
The Harvester , DNSMAP, Fierce, Subbrute and many more ..

Out of all above tool we will see how to find sub-domains using subbrute.Generally while doing testing i always prefer to use Subbrute and the reason is

• Basically Sub brute is being used by pentesters for over 3 years and has not lost its place because the tools uses multi-threading using python engine.

• This tool also contains a large list of real sub-domain that you will find in the wild. Basically we were fed up with

• Fierce / fierce2, and every other tool we used so we found something way faster in python. This tool will not only brute force sub domains.

• It will also gather information about them as well. By default this tool does subdomain enumeration about 8 times faster than Fierce, and can chew through 31k lookups in about 5 minutes on a normal connection. A notable improvement over every other

You can install subbrute either on your windows machine or on kali-linux, so lets start how to use subbrute on windows machine and kali-linux.

Set up in Windows machine 

Step 1 : Download the subbrute on Windows from here   

Step 2:-  Make sure you have python and dnspython installed on your machine

Step 3:- After the installation part go to the directory where you have unzip the subbrute in my case it is
             C:\Users\Nile$h\Desktop\Sub-domain Takeover_Tool_study\subbrute-master\windows

Fig 1: File location of subbrute.exe


Step 4: Now hold Ctrl + Shift + Right click on mouse and Click on Open command window here 

          Fig 2: Opening command prompt on subbrute installed path

Step 5 : Opening Command prompt

                                                                Fig 3:  Opening command prompt 

Step 6 : Now we will execute the command as follow :- subbrute.exe target.com
             In our case say we are finding sub-domains of Facebook site then command would be
             subbrute.exe facebook.com

                                                                 Fig 4:  Finding Facebook sub-domains 


Set up in Kali-Linux 

Step 1 : Download the subbrute on Kali-Linux from here  

Step 2: Unzip the downloaded file

  Fig 5:  Unzip the subbrute-master zip file 

Step 3: Go to the location of the file  i.e 

                                                                       Fig 6:  Location of  subbrute-master file 

Step 4: Now execute the command as follow ./subbrute.py target.com
            In our case say we are finding sub-domains of Google then command would be
            ./subbrute.py google.com

                                                                      Fig 7:  Finding Google sub-domains

I hope you learn something new, if you have any queries or doubt you can comment or DM.

If you like my article then share it and subscribe. Thanks you

Share this

Author : Nilesh Sapariya

Related Posts