Information Gathering - Web - Skills Assessment #4

I’m wondering if I have to dig deeper than just *.githubapp.com. There is nothing by the name of *triage*.githubapp.com.

Do I really need to script something to dig through 57 of these 1st-level subdomains or did I miss something else? I’m not getting hits for triage.[x,y,z].githubapp.com either

Oh they changed it! It used to be which subdomain has the word elephants in it.

Have you tried the passive approach? I can never get Sublist3r to work.

that seems to have worked. apparently sublist3r isn’t the greatest.

I haven’t been able to solve this task using subdomain brute forcing. But I found an online service which gave me the result. Finding such service was pretty easy, but send me a message if you need another hint.

yup. just went online and found it. thanks for the response.

I went and tested Sublist3r. I think the search engines that are blocking it. It never displayed the right result, but there were a few times that it actually worked and displayed a handful of subdomains.

subbrute.py doesn’t seem to behave either. ig “manual” is the way to go.

1 Like

Thanks this helped me. I was wondering why sublist3r was not getting the subdomain I was looking for.