<story><title>A penetration tester’s guide to sub-domain enumeration</title><url>https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6</url></story><parent_chain></parent_chain><comment><author>belorn</author><text>For those on the defending side, remember that the purpose of DNS is to be public. Relying on DNS information to stay secret in order to protect vulnerable application is a bad idea. A service with a SQL injection is unlikely to last long, and as the article shows, it is not hard to enumerate DNS records if you are under a targeted attack.</text></comment>
<story><title>A penetration tester’s guide to sub-domain enumeration</title><url>https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6</url></story><parent_chain></parent_chain><comment><author>jcims</author><text>The CommonCrawl dataset is another good source of host and subdomain information.  The index server is here: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;index.commoncrawl.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;index.commoncrawl.org&lt;/a&gt;  There&amp;#x27;s a client referenced on that page.&lt;p&gt;&lt;pre&gt;&lt;code&gt;  [ec2-user@x cdx-index-client]$ .&amp;#x2F;cdx-index-client.py -c CC-MAIN-2017-43 &amp;#x27;*.ycombinator.com&amp;#x27;
  2017-11-11 22:50:08,381: [INFO]: Getting Index From http:&amp;#x2F;&amp;#x2F;index.commoncrawl.org&amp;#x2F;CC-MAIN-2017-43-index
  2017-11-11 22:50:08,387: [INFO]: Starting new HTTP connection (1): index.commoncrawl.org
  2017-11-11 22:50:08,468: [INFO]: Fetching 2 pages of *.ycombinator.com
  2017-11-11 22:50:08,477: [INFO]: Starting new HTTP connection (1): index.commoncrawl.org
  2017-11-11 22:50:08,478: [INFO]: Starting new HTTP connection (1): index.commoncrawl.org
  2017-11-11 22:50:10,409: [INFO]: 1 page(s) of 2 finished
  2017-11-11 22:50:11,711: [INFO]: 2 page(s) of 2 finished
  [ec2-user@x cdx-index-client]$ awk -F&amp;#x27;)&amp;#x27; &amp;#x27;{print $1}&amp;#x27; domain-y* | sort | uniq -c
       66 com,ycombinator
       38 com,ycombinator,apply
      500 com,ycombinator,blog
        2 com,ycombinator,fellowship
        2 com,ycombinator,macro
    24036 com,ycombinator,news
       25 com,ycombinator,old
        2 com,ycombinator,ycblog&lt;/code&gt;&lt;/pre&gt;</text></comment>