I’m wondering if I have to dig deeper than just *.githubapp.com. There is nothing by the name of *triage*.githubapp.com.
Do I really need to script something to dig through 57 of these 1st-level subdomains or did I miss something else? I’m not getting hits for triage.[x,y,z].githubapp.com either
Oh they changed it! It used to be which subdomain has the word elephants in it.
Have you tried the passive approach? I can never get Sublist3r to work.
that seems to have worked. apparently sublist3r isn’t the greatest.
I haven’t been able to solve this task using subdomain brute forcing. But I found an online service which gave me the result. Finding such service was pretty easy, but send me a message if you need another hint.
yup. just went online and found it. thanks for the response.
I went and tested Sublist3r. I think the search engines that are blocking it. It never displayed the right result, but there were a few times that it actually worked and displayed a handful of subdomains.
subbrute.py doesn’t seem to behave either. ig “manual” is the way to go.
Thanks this helped me. I was wondering why sublist3r was not getting the subdomain I was looking for.
i tried several online tools and commandline tools as well. i found thousands of subdomains but no one has “triage” in it.
I do not know what else to try
like the hint says, use crt.sh i used Ctrl F to find the word triage