(sub)domain enumeration

OWASP, short for the Open Worldwide Application Security Project, is a non-profit foundation dedicated to enhancing software security. It offers a wealth of free resources — including documentation, tools, and training — to help individuals and organizations develop more secure applications. OWASP is best known for its “OWASP Top 10,” a widely recognized list of the most critical web application security risks. In this article, I will reference several OWASP tools that are particularly useful for domain and subdomain enumeration.

OWASP DirBuster

DirBuster is a valuable asset for discovering hidden files and directories on web servers. Thanks to its Java-based GUI, DirBuster is very user-friendly and easy to operate. You can find detailed information about this tool [here](http://You can find detailed information about this tool on the Medium page linked below.). DirBuster, despite its name, is not primarily designed for subdomain discovery. It focuses on finding directories and files within a website. While it can be used to check for the existence of subdomains by testing them as directories, it’s not the most efficient or intended method.

DirBuster

OWASP AMASS

While DirBuster excels at discovering files and directories on web servers, Amass is highly effective at identifying subdomains. Using both tools together provides a more comprehensive assessment.

Passive enumeration

Passive enumeration is a stealthy reconnaissance technique used when active probing may not be appropriate. Instead of directly interacting with the target’s infrastructure, it gathers information by querying third-party sources such as Shodan, Censys, and VirusTotal.

amass enum -passive -d example.com

Active enumeration

Active enumeration involves real-time DNS resolution to validate discovered subdomains. It’s best used when performing DNS queries is both permitted and appropriate, especially when accurate and up-to-date results are required.

amass enum -active -d example.com

Brute force enumeration

Brute-force enumeration uses a dictionary (wordlist) to uncover subdomains by systematically guessing names. It’s especially useful for discovering obscure or unknown subdomains that aren’t indexed by search engines or listed in public datasets.

amass enum -brute -w wordlist.txt -d example.com

Combined mode enumeration

Combined mode enumeration uses custom DNS resolvers in order to avoid rate limiting and to improve accuracy. The list of DNS resolvers can contain providers like Cloudflare (1.1.1.1) and Google (8.8.8.8) for optimal results.

amass enum -active -brute -w wordlist.txt -rf resolvers.txt -d example.com

Output to file

Amass allows you to export results to a file, making it easy to store and analyze the data later

amass enum -active -brute -w wordlist.txt -d example.com -o csv -o subdom.csv

To see the list of discovered subdomains:

cat subdom.csv | grep a_record

Api keys

For some services, it is possible to use API keys. API keys can be configured in a datasources file to be used by Amass. Download the example datasources file, enter API keys and store the file as datasources.yaml

datasources:
  - name: 360PassiveDNS
    ttl: 3600
    creds:
      account: 
        apikey: null
  - name: ASNLookup
    creds:
      account: 
        apikey: null
  - name: Ahrefs
    ttl: 4320
    creds:
      account: 
        apikey: null
  - name: AlienVault
    creds:
      account: 
        apikey: null
  - name: BeVigil
    creds:
      account: 
        apikey: null
  - name: BigDataCloud
    creds:
      account: 
        apikey: null
...

Next, download the config file. As you can see, datasources.yaml is referenced in this config file. Save the config file as config.ini.

scope:
  domains: # domain names to be in scope
    - example.com
...
  datasources: "./datasources.yaml" # the file path that will point to the data source configuration
...

Now that everything is set up the tool can be used.

amass enum -active -brute -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 
-config config.ini -o csv -o subdom.csv -d example.com

Simple test

I created a simple config.ini file:

scope:
  domains: # domain names to be in scope
    - shell.com
options:
  datasources: "./datasources_shodan.yaml" # the file path that will point to the data source configuration

I added the Shodan API key to the datasources_shodan.yaml file:

datasources:
  - name: Shodan
    ttl: 10080
    creds:
      account: 
        apikey: ************* [redacted]

# this is the global options that will be considered. For example, minimum_ttl would be a global option used to compare
# the minimum_ttl to the other datasources ttl.
global_options: 
  minimum_ttl: 1440

Then, I ran the following command:

amass enum -config config.ini

The result is a nice list of subdomains!

Conclusion

OWASP provides excellent tools like DirBuster, Amass, and the popular ZAP. Combining these tools enhances your ability to uncover vulnerabilities and strengthen overall security. Good luck !