So the next two on the list is a tool called a mass.
Now a mass is also used for subdomain hunting and it is fantastic tool.
Now you might be asking why do I care about another tool for subdomain hunting.
Well every tools a little bit different in how it pulls down its subdomains.
And if you combine multiple subdomain tools you're bound to find more subdomains.
And remember if we're only limiting ourselves to something like Tesla dot com and not looking at all
the subdomains when we're doing a web app assessment then we could potentially miss out if we're doing
bug bounties.
We could potentially miss out on a lot of different development sites or you know sites that are out
there that we don't know about.
And if we're doing a pen test then we can miss out on subdomains that we should have pen tested against.
And we're going to tell the client hey you know you were good to go on this.
But in reality they weren't.
If we didn't look through everything.
So let's go ahead and download a mass as well and a mass is made by a loss which is the official web
app security.
So you're going to see a loss quite a bit.
And if we click down into here scroll down just a bit.
You're going to see that it has an installation guide now in the installation guide.
We're just going to scroll down a little bit here and you're going to follow these steps from source.
So this is again another go tool.
All you gotta do is export this go 1 1 1 module and then go ahead and paste this in here just like this
so I'm going to minimize this and you're going to see that I've already done it.
So go ahead and do it for you.
It is a bit of it takes a bit of time is what I should say maybe a minute or two.
Go ahead and let this install and then pause the video.
Meet me back when you're ready OK.
So now what I'm going to do is we're going to build in a mass into our script and I'm gonna run a mass
as is so you can see what it's capable of doing but a mass takes some time.
So the way we're gonna run a mass is we're gonna say Amos he Newham and then we're going to pick the
domain in the domain is Tesla that.
All right.
So that's all we're gonna do.
Now let's build this into our script.
This is running.
It's going to take quite a bit of time again and we'll let this run as we do it and then I'm going to
comment this out in the script.
So that way when we write it for future tests it's going to be a lot faster.
So what we're gonna do here is we're gonna go ahead and just say ECHO AND WE'RE GONNA echo out.
Same thing we're just going to say something like like a type we're gonna say harvesting subdomains
with famous
OK.
And again I didn't realize it but I screwed up over here all right because for some reason it's not
typing in the plus side when I'm doing it.
So here we're gonna say a Mass enum just like we did before domain thylacine you or L and what we'll
do is we'll put this into the recon folder as well so we'll just call this we'll call this your l recon
and we'll just call this f dot Tex because we're gonna make this final that text at some point so we're
gonna take this and sort everything here that we find we're gonna put this into your l recon final.
OK.
So we have two options of how we can do this.
We could actually put this into we could put this all in the final text and then sort it which is fine
actually if we want to do that the other option which I was going to show you is sorting it out a different
way but we can put it into final and but then we would have to sort remove.
So actually I'm going to leave it like this and we're gonna do this kind of like this.
We're going to sort this into you are L recon final that text and we'll take the final and move it into
a new file here in a second.
So we've got this and then we're gonna do is we're gonna just go ahead and remove your l recon f that
text.
OK.
So we don't have to create anything new.
As of right now the folders are all the same.
And this is going to pull this down.
What I want you to go ahead and do is I want you to comment this out.
We're not going to use this for the remainder of the course.
I do want you to see that Amos is pulling down quite a bit of information and you could see it's just
I mean it takes a lot of time but it's going to find different things here than what we found originally
with just asset finder so we can combine these two here and come down with it and just finish.
So that's how long it would take come down with a list combine those into a final that text in in the
next video.
We would combine those into one big file with it all sorted out.
So we don't have any repeats so I'm going to show you in the next video How to probe for these being
alive or not which is going to save a lot of time for us.
So I'll catch you over in the next video and we start talking about h t t pro.