# Subdomain Enumeration Tools

Hello, everyone!

In today's text, I will show the main tools for subdomain enumeration, a technique widely used to gather information and potential targets to increase the attack surface of a target.

Enumeration is one of the first phases of a CTF, pentest, or vulnerability analysis of a web system. One thing attackers enumerate is the subdomains related to the victim's main domain.

Today I will demonstrate some tools used in this process and teach you how to download and use these helpers.

For the installations below to work, you need to have Python 3 and GO installed on your machine.

---

### **sublist3r**

Installation

```bash
git clone https://github.com/aboul3la/Sublist3r.git
cd sublist3r
sudo pip install -r requirements.txt
```

Use

```bash
python3 sublist3r.py -h # See help
python3 sublist3r.py -d $url # Define domain to be enumerated
python3 sublist3r.py -v -d $url # Verbose mode
python3 sublist3r.py -b -d $url # Domain brute-force
```

Example

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1721244365026/b6963b45-4cf5-48ba-b474-7012f991dcf5.png align="center")

---

### amass

Installation

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">The command <code>mv [tool] /usr/local/bin</code> moves the file to the <code>/usr/local/bin</code> folder so that the tool can be invoked from any directory.</div>
</div>

```bash
wget https://github.com/OWASP/Amass/releases/download/v3.17.0/amass_linux_arm64.zip
unzip amass_linux_arm64.zip
cd amass_linux_arm64
mv amass /usr/local/bin
```

Use

```bash
amass enum -h # See help
amass enum -d $url # Define domain to be enumerated
amass enum -silent -d $url # Quiet mode, suppresses output
amass enum -o example.txt -d $url # Send output to example.txt file
```

Example

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1721244497161/cea20aca-5c5c-4680-9d1b-3ef160e53ab3.png align="center")

---

### assetfinder

Installation

```bash
go get -u github.com/tomnomnom/assetfinder
# Locate where the tool has been installed
# Since I installed it with the root user, it is in /root/go/bin/
mv /root/go/bin/assetfinder /usr/local/bin
```

Use

```bash
assetfinder --subs-only $url # Define target to be enumerated
```

Example

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1721244750940/33bf2031-8a07-43a8-bcd6-909e8ba170ad.png align="center")

---

### **findomain**

Installation

```bash
wget https://github.com/findomain/findomain/releases/latest/download/findomain-linux
chmod +x findomain-linux
mv /root/go/bin/findomain-linux /usr/local/bin
```

Use

```bash
findomain-linux -h # Seehelp
findomain-linux -t $url # Define target to be enumerated
findomain-linux -q -t $url # Quiet mode, suppresses output
findomain-linux -v -t $url # Verbose mode
findomain-linux -o -t $url # Send output to a text file with target name
```

Example

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1721244962925/af10812b-80db-4269-ad3b-6a8a3ad82739.png align="center")

---

### subfinder

Installation

```bash
GO111MODULE=on go get -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder
mv /root/go/bin/subfinder /usr/local/bin
```

Use

```bash
subfinder -d $url # Define target to be enumerated
subfinder -silent -d $url # Quiet mode, suppresses output
subfinder -o example.txt -d $url # Send output to example.txt file
```

Example

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1721245040815/62470b07-b289-4ffb-9373-0c1b4dc58bcc.png align="center")

---

### Script

To make it easier to use these tools, I created a script that combines some of the tools mentioned in this article, which can be found at [this link](https://github.com/b1d0ws/PentestTools/blob/main/enumSubs.sh).

Note that this is a script created for personal use, so it includes tools that need to be pre-installed and globally accessible to work correctly, which are:

* assetFinder
    
* findomain-linux
    
* subfinder
    
* amass
    
* anew
    
* httpx
    

Basically, the script runs all the enumeration tools and creates a file for each result, as well as creating a file with all the subdomains found and another with all the accessible ones.

![script](https://b1d0ws.github.io/subdomains/script.png align="left")

---

### Conclusion

In this article, 5 tools for subdomain enumeration were presented. This is a very important part when performing a pentest, vulnerability analysis, and other activities that involve mapping a target.

By performing this enumeration, the surface that can suffer attacks and have vulnerabilities often increases considerably.

See ya =)