Hello friends i stuck on the question “Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com.”
I launch the dns enum but nothing can see about subdomain except ns1,ns2,ns3,support,my,blog,customer. Need help !
Hi,
when asking for technological support it is crucial to append:
- Full command you used
- Output of that command
There are many ways to do everything and it is helpful to know your(!) approach to the topic.
I tried both of these:
dnsenum --enum inlanefreight.com -f /usr/share/wordlist/Discovery/DNS/subdomains-top1million-20000.txt --threads 90
dnsenum --enum inlanefreight.com -f /usr/share/wordlist/Discovery/DNS/subdomains-top1million-110000.txt --threads 90
It only finds ns1, ns2, ns3, www, support, blog, customer, and my. I tried using dnsenum and gobuster with a variety of different options. I also tried some base options with amass, dnsrecon, fierce and assetfinder but didn’t go in depth on the optional parameters.
Any ideas?