---
description: In order to increase the attack surface, we perform subdomain enumeration.
---

# Sub-Domain Enumeration

Three Methods for Sub-Domain Enumeration

1 Brute Force

2 OSINT

3 Virtual Host



### OSINT SSL/TLS

Use sites like:

1 [ https://crt.sh](https://crt.sh)

2 [ https://ui.ctsearch.entrust.com/ui/ctsearchui ](https://ui.ctsearch.entrust.com/ui/ctsearchui)

### OSINT Search Engine&#x20;

Use: site:\*.examplesite.com



### DNS Brute Forcing&#x20;

```
dnsrecon -t brt -d examplesite.com
```

### Sublist3r

If you are preparing for OSCP or solving machines on HacktheBox or training for CTFs then this is the command you need to go for.

Install by using this command

```
sudo apt install sublist3r
```

```
./sublist3r.py -d http://[target ip address]
```

### Virtual Host

Some subdomains such as development versions and administration portals are not always hosted in publically accessible DNS results. However, we can still find them, by abusing the **HOST** header

First, run this first command to identify the size number that shows up the most then use the second command with the identified size&#x20;

```
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.examplewebsite.com" -u http://[target Machine ip address]
```

Replace the {size } with the size identified

```
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.examplewebsite.com" -u http://[target Machine ip address] -f {size}
```
