Domained : Multi Tool Subdomain Enumeration

Domained is a domain name enumeration tool. The tools contained in it requires Kali Linux (preferred) or Debian 7+ and Recon-ng.

It uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output).

Initial Install

  • Domained tools

python3 domained.py –install

  • Python required modules

sudo pip install -r ./ext/requirements.txt

Other Dependencies

  • ldns library for DNS programming:

sudo apt-get install libldns-dev -y

  • Go Programming Language:

sudo apt-get install golang

NOTE: This is an active recon – only perform on applications that you have permission to test against.

Also Read – Chromepass : Hacking Chrome Saved Passwords

Tools Leveraged

Usage

First Step:
Install Required Python Modules: sudo pip install -r ./ext/requirements.txt
Install Tools: sudo python3 domained.py –install

Example 1: python3 domained.py -d example.com
Uses subdomain example.com (Sublist3r (+subbrute), enumall, Knock, Amass, and SubFinder)

Example 2: python3 domained.py -d example.com -b -p –vpn
Uses subdomain example.com with seclist subdomain list bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall, and SubFinder), adds ports 8443/8080 and checks if on VPN

Example 3: python3 domained.py -d example.com -b –bruteall
Uses subdomain example.com with large-all.txt bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall and SubFinder)

Example 4: python3 domained.py -d example.com –quick
Uses subdomain example.com and only Amass and SubFinder

Example 5: python3 domained.py -d example.com –quick –notify
Uses subdomain example.com, only Amass and SubFinder and notification

Example 6: python3 domained.py -d example.com –noeyewitness
Uses subdomain example.com with no EyeWitness

Note: –bruteall must be used with the -b flag

OptionDescription
–install/–upgradeBoth do the same function – install all prerequisite tools
–vpnCheck if you are on VPN (update with your provider)
–quickUse ONLY Amass and SubFinder
–bruteallBruteforce with JHaddix All.txt List instead of SecList
–freshDelete old data from output folder
–notifySend Pushover or Gmail Notifications
–activeEyeWitness Active Scan
–noeyewitnessNo Eyewitness
-dThe domain you want to preform recon on
-bBruteforce with subbrute/massdns and SecList wordlist
-s nOnly HTTPs domains
-pAdd port 8080 for HTTP and 8443 for HTTPS

Notifications

  • Complete the ext/notifycfg.ini for Pushover or Gmail notifications. (Enable must be set to True)
  • Please see the Pushover API info here and instructions on how to allow less secure apps on your gmail account here

Credit: ccsplit, jafoca, mortymorty, Chan9390, dainok & Apoorv Raj Saxena

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

7 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

7 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

7 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago