PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Discovering Subdomains

bugcrowd.com | blog | #bug-bounty | #reconnaissance | #shodan | #subdomain-discovery | #google-dorks | #crt-sh
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A bug hunter's guide to subdomain discovery on wildcard scopes: combining Google dorks, VirusTotal, DNSDumpster, crt.sh certificate transparency and Shodan beats any single technique.
Published
Collected

Related coverage

blog · bugcrowd.com
Shodan: The Search Engine For Hackers
Shodan indexes service banners, ports, and metadata across IPv4 space to reveal exposed systems and configuration risks; teams use it for asset discovery and authorized reconnaissance.
blog · bishopfox.com
ripgen: Taking the Guesswork Out of Subdomain Discovery
Bishop Fox's Cosmos team introduces ripgen, a fast subdomain permutation discovery tool, explaining why subdomain discovery—including neglected staging environments—is key to attack surface mapping.
blog · bishopfox.com
XMPP: An Under-appreciated Attack Surface
Why XMPP deserves more pentester attention: Shodan shows hundreds of thousands of exposed servers, and misconfigurations leak usernames, chat logs, and Pub/Sub data across industries.
blog · bishopfox.com
SearchDiggity: Avoid Bot Detection Issues by Leveraging Google, Bing, and Shodan APIs
How to stop SearchDiggity scans from being blocked by Google's bot detection: use the official Google, Bing and SHODAN APIs instead of scraping, avoiding CAPTCHA and 15-minute auto-resume pauses.
blog · yeswehack.com
‘One challenging thing about Bug Bounty is when it’s black box’: sunshinefactory on bug hunting, CTFs and hardware hacking
YesWeHack interviews sunshinefactory (Yuewei Wu), part of the winning team at the SPIRITCYBER hardware contest, on IoT hacking methodology, CTF versus bug bounty, and career advice.
blog · yeswehack.com
Recon series recap: The ultimate guide to Bug Bounty reconnaissance and footprinting
Recap of a six-part recon series covering hidden endpoints, subdomain enumeration, HTTP fingerprinting, hidden parameters and Google dorking, with tools like Nmap, Shodan and the Wayback Machine.
Back