1.1. 构造域名

前面通过各种收集方式已经获取到了大量的子域名了,但这真的就是全部了吗??当然不是!!!!

我们可以通过置换再生成一批域名,比如我们收集到admin.aaa.xxx.com,那么是不是也可能存在一个dev-admin.aaa.xxx.com呢?

通过这种方式再生成一批,然后验证存活率,结果肯定会更全!!!

之前自己写过工具,后面发现已经有前人写好了,那就是 altdns

1.1.1. altdns

https://github.com/infosec-au/altdns

Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.

自己看说明文档吧,可以根据经验自定义或者补充添加一些关键词...

image-20220106143432438

Copyright © d4m1ts 2022 all right reserved,powered by Gitbook该文章修订时间: 2022-01-06 14:35:06

results matching ""

    No results matching ""