Passive
A passive resource means that you will grab subdomains that were already discovered by another tools or were found lying around in some place (open source code, legacy scripts, logs, etc).
# https://github.com/OWASP/Amass
amass enum -passive -d domain.com
# https://github.com/projectdiscovery/subfinder
subfinder -d domain.com -all -silent
# https://github.com/lc/gau
# https://github.com/tomnomnom/unfurl
gau --subs example.com | unfurl -u domains
# https://github.com/hahwul/urx
urx example.com --subs | unfurl -u domainsbbot
pipx install bbot
bbot -t evilcorp.com -p subdomain-enum -rf passiveAll in one script
amass enum -passive -d $1 -o amass_$1.txt > /dev/null 2>&1
echo "[+] Amass done"
subfinder -silent -d $1 -all -o subfinder_$1.txt > /dev/null 2>&1
echo "[+] Subfinder done"
urx $1 --subs | unfurl -u domains > urx_$1.txt
echo "[+] urx done"
cat subfinder_$1.txt urx_$1.txt amass_$1.txt | uniq $1_subdomains
rm subfinder_$1.txt urx_$1.txt amass_$1.txtGoogle analytics ID
Extract Google tag manager from webiste, format: UAXXXXXX
- https://builtwith.com/relationships/tag/UAXXXXXX
- https://api.hackertarget.com/analyticslookup/?q=UAXXXXXX
- https://spyonweb.com/UAXXXXXX
# https://github.com/Josue87/AnalyticsRelationships
cat subdomains.txt | analyticsrelationshipsGoogle Tag Manager
https://googletagmanager.com/gtm.js?id=TAGIDFavicon
Search for favicon md5 value in known search engines to find websites related to your search
Tip: Use http.favicon.hash:<hash> on Shodan
Tip: Use icon_hash="<hash>" on FOFABoth take the same mmh3 hash, but the index is different, so run the hash through both.
See more shodan dorks here: https://github.com/dootss/shodan-dorks
AI
subwiz -i subdomains.txt