<h1>Footprinting with Sublist3r</h1>

Sublist3r is a Python subdomain discovery tool that has been designed to enumerate subdomains of websites using data from publicly available sources and brute force techniques. The public sources consist of a wide range of popular search engines such as Google, Yahoo, Bing, Baidu, Ask and also Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS to discover subdomains.

You can also brute force subdomains using an integrated tool named Subbrute. Subbrute is a DNS meta-query spider that enumerates DNS records and subdomains by using an extensive wordlist. This tool uses open resolvers to avoid rate limiting issues that prevent Subbrute from completing the list or attempting all entries.

Sublist3r installation

Sublist3r is not pre-installed in Kali Linux, so you will have to install it from the official repository.

If you are installing Sublist3r on Ubuntu 19.10, you will need to prepare your system:

• Update your system and install required software:

$ sudo apt-get update && sudo apt-get upgrade

$ sudo apt-get install git

$ sudo apt-get install python-pip python-dev build-essential

$ sudo pip install --upgrade setuptools pip wheel

$ sudo pip install --upgrade virtualenv

• Next, clone Sublist3r Github. In this tutorial we clone to the /opt directory but feel free to use whatever directory structure works for you.

git clone https://github.com/aboul3la/Sublist3r.git

• Next, change directory into the newly created Sublist3r and use the requirements file to finish installing the dependencies for Sublist3r.

cd Sublist3r

pip install –r requirements.txt

• At this point the installation is complete and the application can be started from the current Sublist3r directory.

./sublist3r.py

NOTE: If you are using Kali Linux you can start the application manually by typing Sublist3r in your terminal or you can add it to the Applications menu.

Using Sublist3r

Like Osmedeus, Sublist3r does not require you to configure any API keys. Therefore, this application is fairly simple to use.

So far, we’ve only searched publicly available sources for sub domains for the given domain name. In the next step we will also activate Subbrute which uses a wordlist to brute force subdomains. The results will be saved in a text file under the proper directory.

• The following command activates Subbrute with 100 threads:

./sublist3r.py -d sans.org -v -b -t 100 -o /root/Documents/SANS/sublister.txt

Conclusions:

Even though not being updated recently, Sublister is still a reliable tool to find subdomains.

Next post: Advanced Reconnaissance: Compiling gathered information