In a previous lecture.
We have seen how we can find subdomains using such operators and using a website called Quraysh.
In this lecture, I would like to show you two tools that you can use to find subdomains of any domain
name and to check which subdomain is live.
So to install this tool, all you have to do is just to open the terminal and type apt install.
And then the first tool which is sub finder.
And then the second tool which is HTTP probe.
So the first thing you want to do is just to go to your virtual machine and open the terminal as root.
And then you want to type the password, which is Osint.
And before installing these tools you want to type APT update to update the repositories.
And then you want to install the tools by typing APT install sub finder and then http probe like this
and hit enter.
And in my case they are already installed.
So to use the first tool, all you have to do just to type sub finder.
And then I'm going to add minus h to find the options that I can use with this tool.
And I always like to use three options.
The first one is called silent.
That will only show me the found subdomains.
The second option is called -0, which will save all the found subdomains to a file.
And the third option is minus d, which is used to specify the domain name that you are trying to find
its subdomains.
So I'm going to type sub finder like this.
And then minus d.
And I'm going to try to find the subdomains of cyber Sudoku org.
And then I'm going to add an option called silent to only see subdomains that have been found.
And then minus.
Oh, and I would like to create a file called subdomains on my desktop.
So I'm going to add the full path which is in home Osint desktop.
And I would like to call the file subdomains dot txt.
So right now, all the subdomains that are going to be found are going to be saved in this file.
Now I'm going to hit enter.
And we can see that a file has been generated on our desktop.
And as you can see these are the subdomains that have been found.
Now the problem with these subdomains is that some subdomains are not accessible or they are not live.
So let me copy this one for example, and then open my browser and then paste the URL.
And we can see that we cannot access this website.
And if we try to copy this link as well that starts with w-w-w and paste it in our browser, we can
see that this site is also not accessible.
But Cyberstalk and Academy that cyberstalk were completely fine.
So the question is how can we only find subdomains that are live?
And to do this, we are going to use the second tool that we have installed that's called HTTP probe.
So to use this tool, I would like to use the exact same command that I have used before.
And then I'm going to add a pipe.
And then I'm going to say HTTP probe like this and hit enter.
And this should only show us subdomains that are live.
So we can see that the academy and cyber studio have been excluded.
Now the question is what if you would like to only get or view links that start with Https or HTTP?
So to do this we can use a tool called grip to exclude either HTTP or Https.
So I would like to use the exact same command and then add pipe at the end.
And then I'm going to say grip minus v to exclude.
And I would like to exclude everything that starts with http colon.
And then I'm going to close it with a single coat.
So first of all, Sub finder is going to find all subdomains of cyber pseudo org.
And it will only show us subdomains and nothing else.
And once it finds subdomains it's going to save them to a file called sub domain dot txt.
And then we are using http prop to check which subdomain is live and which subdomain is not live.
And then we are using grip to exclude all search results that start with http colon.
So let me hit enter.
And as you can see now we have only got two search results that start with Https.
And if we tested these two links they should work.
So I'm going to copy the first link and then paste it in my browser.
And we can see that it works.
And now I'm going to test the second link.
And this one works as well.