I’m wondering if I have to dig deeper than just *.githubapp.com. There is nothing by the name of *triage*.githubapp.com.
Do I really need to script something to dig through 57 of these 1st-level subdomains or did I miss something else? I’m not getting hits for
Oh they changed it! It used to be which subdomain has the word elephants in it.
Have you tried the passive approach? I can never get Sublist3r to work.
that seems to have worked. apparently sublist3r isn’t the greatest.
I haven’t been able to solve this task using subdomain brute forcing. But I found an online service which gave me the result. Finding such service was pretty easy, but send me a message if you need another hint.
yup. just went online and found it. thanks for the response.
I went and tested Sublist3r. I think the search engines that are blocking it. It never displayed the right result, but there were a few times that it actually worked and displayed a handful of subdomains.
subbrute.py doesn’t seem to behave either. ig “manual” is the way to go.
Thanks this helped me. I was wondering why sublist3r was not getting the subdomain I was looking for.