# Subdomains Enumeration

### Google Dorks  for Subdomain Enumeration

```
"certifiedhacker.com"
site:*.tryhackme.com
-site:www.tryhackme.com  site:*.tryhackme.com \\except main website
```

### Finding Subdomains

{% embed url="<https://pentest-tools.com/>" %}

{% embed url="<http://archive.org/web/>" %}

{% embed url="<https://subdomainfinder.c99.nl/>" %}

{% embed url="<https://searchdns.netcraft.com>" %}

{% embed url="<https://securitytrails.com/>" %}

{% embed url="<https://dnsdumpster.com/>" %}

### Kali Tools (Subdomain Enumeration)

{% embed url="<https://github.com/aboul3la/Sublist3r>" %}

{% embed url="<https://github.com/owasp-amass/amass>" %}
slow but good
{% endembed %}

```
amass enum -v -d tryhackme.com
```

{% embed url="<https://www.kali.org/tools/subfinder/>" %}

{% embed url="<https://github.com/tomnomnom/assetfinder>" %}

{% embed url="<https://github.com/blacklanternsecurity/bbot>" %}

{% embed url="<https://github.com/incogbyte/shosubgo>" %}
Passive with shodan
{% endembed %}

### API Keys to increase your dataset

{% embed url="<https://chaos.projectdiscovery.io/>" %}

<figure><img src="https://3611344181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZ9YXiuadJvkUT6WHdoXZ%2Fuploads%2FPFM1g8oiyISdlljOY4la%2Fimage.png?alt=media&#x26;token=d8d5c083-8b54-47e5-bd6a-da98c632dcc2" alt=""><figcaption><p>Paid</p></figcaption></figure>

{% embed url="<https://netlas.io/>" %}
Paid
{% endembed %}

### Check if subdomains are Alive

{% embed url="<https://github.com/tomnomnom/httprobe>" %}

<figure><img src="https://3611344181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZ9YXiuadJvkUT6WHdoXZ%2Fuploads%2Fc9eGMpmYOZrBJ23qzoTk%2Fimage.png?alt=media&#x26;token=6e66b0f1-ec87-4bef-aca7-7be9c4d62ab3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3611344181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZ9YXiuadJvkUT6WHdoXZ%2Fuploads%2FbAASeGHCbTSjusnVFiLM%2Fimage.png?alt=media&#x26;token=0eda94b3-f92f-4e8d-a36a-c38989413e9e" alt=""><figcaption></figcaption></figure>

### Screenshot Alive domains

{% embed url="<https://github.com/sensepost/gowitness/wiki/Installation>" %}