A key phase in the steps to penetration testing is reconnaissance.\u00a0Without reconnaissance, pentesters would be essentially blind.<\/p>\n
In addition to this, pentesters have myriad of tools to help them with the recon phase.<\/p>\n
When hunting down hosts that belong to an organization, dnsmap<\/a> is a wonderful tool for finding subdomains.<\/p>\n After doing some experimenting with this tool, I stumbled upon a limitation. Dnsmap does not have the capability to read from stdin for keywords to use in the subdomain bruteforcing. It requires a word list. Well what if I want to use john the ripper?<\/p>\n So, I pondered to myself, “What’s wrong with just ‘host’ and ‘john’ in tandem to bruteforce subdomains?”. Well my friends, here’s an example:<\/p>\n Of course you could change this to accordingly, but here’s it as a function and you could even add this to your .bashrc file.<\/p>\n More to come as usual.. <\/p>\n (I’m still dragging my feet on ettersploit.. \ud83d\ude42 )<\/p>\n","protected":false},"excerpt":{"rendered":" A key phase in the steps to penetration testing is reconnaissance.\u00a0Without reconnaissance, pentesters would be essentially blind. In addition to this, pentesters have myriad of tools to help them with the recon phase. When hunting down hosts that belong to an organization, dnsmap is a wonderful tool for finding subdomains. After doing some experimenting with … Continue reading Bruteforcing subdomain names with John the ripper<\/span> \r\njohn --incremental --stdout | while read words; \r\n do host ${words}.google.com &> \/dev\/null; \r\n if [ $? -eq 0 ]; \r\n then echo \"${words}.google.com\"; \r\n fi; \r\n done\r\n<\/pre>\n\r\nfunction dnsbrute {\r\n if [ ${#} -lt 1 ];\r\n then \r\n echo \"I need a domain name...\";\r\n return 1;\r\n fi\r\n john --incremental --stdout | while read words; \r\n do host ${words}.${1} &> \/dev\/null; \r\n if [ $? -eq 0 ]; \r\n then echo \"${words}.${1}\"; \r\n fi; \r\n done\r\n return 0;\r\n}\r\n<\/pre>\n