Hello everyone, so I am doing the subdomain bruteforcing enumeration. Where I have to do the following exercise:
“Using the known subdomains for inlanefreight.com (www, ns1, ns2, ns3, blog, support, customer), find any missing subdomains by brute-forcing possible domain names. Provide your answer with the complete subdomain, e.g., www.inlanefreight.com.”
The only one I can find that is not on the list is my.inlanefreight.com but that is not the one they are looking for.
I tried more things, but this should give you an idea. I also tried changing the name server in resolv.conf to 1.1.1.1 cause a different forum post, about this. Where someone mentioned you should change nameserver to 1.1.1.1 and then run dnsenum again. That also didn’t work.
As it goes with gobuster, using dns will not be useful since the machine is not registered by any DNS server, it is only virtual.
Use gobuster vhost to enumerate subdomains in virtual machines, CTF, or any scenario that a specific domain is not globally registered.
Hey there, thanks for the response. But inlanefreight.com is actually registered by htb on the world wide web, You can go and visit it. I can find other subdomains by using gobuster with dns.
Its not part of a virtual machine.
gobuster dns -d inlanefreight.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt
Oke so I just solved this myself, I want everyone thats reading in the future to notice that the answer is right in front of you. But just give up the right format as an answer. And don’t give up a fully qualified domain name… I wasted a few hours on this while that was totally unecessary.