Network Reconnaissance Tools
Sublist3r Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
sublist3r introduction: sub domain enumration tool
Sublist3r can be used to find sub domains. It should come with Kali Linux but here is an installation command if it is not.
sudo apt install sublist3r
We will start by listing the options that it has, we can use the following command.
sublist3r -h
sublist3r example: searching for google subdomains
As you can see we can use the -d option to search the domain name of our choice. Lets try listing the subdomains of google.com
sublist3r -d www.google.com
sublist3r example: output to text file
Since we can get quite a long list of results, we might want to store these results inside a file. For this, we can use the -o option to output. I will use the same command and add the output
sublist3r -d www.google.com -o results.txt
sublist3r example: finding subdomains with open ports
One of the underated capabilities of this tool is the ability to find sub domains that have specific open ports. We can restrict the results to only show us subdomains that have the ports we want open. We can do this as shown below.
sublist3r -d www.google.com -p 20,21