How to Find Hidden Subdomains: From Passive OSINT to Active Brute Force

Table of Contents Brief Introduction of Subdomain Enumeration Goals Ethical Considerations Demonstration Search Engine Dorking Certificate Transparency Lookup Passive Aggregation with Sublist3r Virtual Host Discovery with ffuf Active DNS Brute Force with Gobuster Key Findings Summary Brief Introduction of Subdomain Enumeration Subdomain enumeration is the process of finding all subdomains that belong to a target domain. Each subdomain is a potential entry point, making this a key step in externa