Sweshi's Tutorials

Sublist3r Tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
sublist3r introduction: sub domain enumration tool

Sublist3r can be used to find sub domains. It should come with Kali Linux but here is an installation command if it is not.

sudo apt install sublist3r

We will start by listing the options that it has, we can use the following command.

sublist3r -h
sublist3r example: searching for google subdomains
Penetration Testing: sublist3r -h

As you can see we can use the -d option to search the domain name of our choice. Lets try listing the subdomains of google.com

sublist3r -d www.google.com sublist3r tutorial: sublist3r -d google.com.
sublist3r example: output to text file

Since we can get quite a long list of results, we might want to store these results inside a file. For this, we can use the -o option to output. I will use the same command and add the output

sublist3r -d www.google.com -o results.txt
sublist3r example: finding subdomains with open ports

One of the underated capabilities of this tool is the ability to find sub domains that have specific open ports. We can restrict the results to only show us subdomains that have the ports we want open. We can do this as shown below.

sublist3r -d www.google.com -p 20,21