All language subtitles for 5. Discovering Subdomains

In today's lecture we're going to talk about subdomains subdomains we've seen them everywhere.

For example they come in as subdomain tartaric dot com.

So for example you'd have better Facebook to call it to have mobile Facebook dot com or you might have

used Erdos Facebook dot com.

So for example in Google you have mailed the Google dot com which basically just takes you to G-mail

y subdomains are important is a lot of the cases some websites have subdues subdomains for their own

users for example for the employees or for certain customers.

So they're not advertised unless you're some sort of a VIP customer or if you are an employee you will

not see the subdomains on search engines and you'll just never see a link leading to them.

So they might contain vulnerabilities or exploits that will help you gain access to the Web site but

you just never knew about them because they're not advertised.

Another thing is a lot of the big Web sites when they're trying to install a new update or add a new

feature to the Web site they install it in a subdomain.

So you'll have bater that Facebook that can actually contains a beta version of Facebook which contains

still experimental features.

Now experimental features are great because they're still under development and there is a really high

chance of finding exploits in them.

And this is actually true not so long ago someone was able to brute force the restore password key for

any Facebook user and was able to gain access to any Facebook user.

And this was only possible through the beta at Facebook dot com because Facebook dot com used to check

for a number of attempts or wrong attempts and they just did it implement that security feature in the

beta because they just didn't think anyone's going to go there or for any reason like the beta usually

contains more problems than the normal website.

So it will be very useful to try and hack into it.

So in today's picture we'll see how we can find any of domains that have not been advertised or even

the advertised ones.

So we'll be able to get subdomains of our target.

We're going to use a tool called knock the tools very simple you don't really need to install it all

you have to do is download it using good command.

So the command is going to be get clone.

And then you put the you are out of the two.

And that's it.

It's downloaded now.

So I'm going to navigate to it using the command and will see that we have the high file here and I'm

going to run it using the command Python

not that's why.

And then I'll put the IPA.

Our website I want to get the subdomains up and it's going to be security guards all

and this will show you some information about the website first and then it'll do a brute force and

a Google based subdomain search for security so it'll show me any subdomain that I security might have.

So that I could try and test the security of that subdomain and see what's installed on it.

Maybe I'll be able to gain access to the website through that subdomain.

OK so the scan is complete now.

And as you can see we managed to find seven subdomains that were not as well.

So one of them is FTB those security dot org security that we already know about this.

This is just a local subdomain.

We can see that the mail server has its own subdomain as well and we can see a very interesting one

here news that I secured this year or this was this actually did contain a beta version of a script

that we were working on and secret.

And at the moment now if you go to it it's actually converted and so just take you to the actual website

because the script is out of development.

But now if you if you go and use that security org it'll just tell you that this has been moved to the

main web site and then if you click here you'll go to the main web site with the script installed.

So if someone was trying to hack into our website and did this they'll actually see that there is a

script under development and there is a high chance that there would have been able to find a vulnerability

in it and gain access to the whole website.

So this just shows you how important information gathering is again which can be used to really gain

access to websites or if you don't do it you'd be missing a lot of things.

For example you might be missing a whole script with a whole number of vulnerabilities or you could

be missing an admin logon page or an employee logon page which is used for admins or employees to log

in.