In today's lecture we're going to talk about subdomains subdomains we've seen them everywhere.
For example they come in as subdomain tartaric dot com.
So for example you'd have better Facebook to call it to have mobile Facebook dot com or you might have
used Erdos Facebook dot com.
So for example in Google you have mailed the Google dot com which basically just takes you to G-mail
y subdomains are important is a lot of the cases some websites have subdues subdomains for their own
users for example for the employees or for certain customers.
So they're not advertised unless you're some sort of a VIP customer or if you are an employee you will
not see the subdomains on search engines and you'll just never see a link leading to them.
So they might contain vulnerabilities or exploits that will help you gain access to the Web site but
you just never knew about them because they're not advertised.
Another thing is a lot of the big Web sites when they're trying to install a new update or add a new
feature to the Web site they install it in a subdomain.
So you'll have bater that Facebook that can actually contains a beta version of Facebook which contains
still experimental features.
Now experimental features are great because they're still under development and there is a really high
chance of finding exploits in them.
And this is actually true not so long ago someone was able to brute force the restore password key for
any Facebook user and was able to gain access to any Facebook user.
And this was only possible through the beta at Facebook dot com because Facebook dot com used to check
for a number of attempts or wrong attempts and they just did it implement that security feature in the
beta because they just didn't think anyone's going to go there or for any reason like the beta usually
contains more problems than the normal website.
So it will be very useful to try and hack into it.
So in today's picture we'll see how we can find any of domains that have not been advertised or even
the advertised ones.
So we'll be able to get subdomains of our target.
We're going to use a tool called knock the tools very simple you don't really need to install it all
you have to do is download it using good command.
So the command is going to be get clone.
And then you put the you are out of the two.
And that's it.
It's downloaded now.
So I'm going to navigate to it using the command and will see that we have the high file here and I'm
going to run it using the command Python
not that's why.
And then I'll put the IPA.
Our website I want to get the subdomains up and it's going to be security guards all
and this will show you some information about the website first and then it'll do a brute force and
a Google based subdomain search for security so it'll show me any subdomain that I security might have.
So that I could try and test the security of that subdomain and see what's installed on it.
Maybe I'll be able to gain access to the website through that subdomain.
OK so the scan is complete now.
And as you can see we managed to find seven subdomains that were not as well.
So one of them is FTB those security dot org security that we already know about this.
This is just a local subdomain.
We can see that the mail server has its own subdomain as well and we can see a very interesting one
here news that I secured this year or this was this actually did contain a beta version of a script
that we were working on and secret.
And at the moment now if you go to it it's actually converted and so just take you to the actual website
because the script is out of development.
But now if you if you go and use that security org it'll just tell you that this has been moved to the
main web site and then if you click here you'll go to the main web site with the script installed.
So if someone was trying to hack into our website and did this they'll actually see that there is a
script under development and there is a high chance that there would have been able to find a vulnerability
in it and gain access to the whole website.
So this just shows you how important information gathering is again which can be used to really gain
access to websites or if you don't do it you'd be missing a lot of things.
For example you might be missing a whole script with a whole number of vulnerabilities or you could
be missing an admin logon page or an employee logon page which is used for admins or employees to log
in.