Listen to this Post
Reconnaissance is the backbone of successful bug bounty hunting. After years of experience, Martín Martín emphasizes that DNS brute-forcing is a game-changer for uncovering hidden subdomains that others miss. Here’s how you can enhance your subdomain discovery process.
Key Tools & Techniques
- ShuffleDNS: A powerful tool for fast DNS enumeration.
- High-Quality Resolvers: Avoid rate limits by using validated DNS servers (check resolvalid).
- Targeted Wordlists: Use language/region-specific wordlists (e.g., Spanish words for Spanish domains).
- Wildcard Scopes: Prioritize programs with `.domain.com` for broader attack surfaces.
You Should Know: Practical DNS Brute-Force Commands & Steps
1. Installing ShuffleDNS
go install github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest
2. Generating a Valid Resolver List
Use resolvalid or manually verify resolvers:
dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 50 -o resolvers.txt
3. Running ShuffleDNS with Custom Wordlists
shuffledns -d example.com -w ~/wordlists/subdomains.txt -r resolvers.txt -o subdomains_found.txt
4. Combining with MassDNS for Large-Scale Scans
massdns -r resolvers.txt -t A -o S -w massdns_output.txt subdomains_list.txt
5. Filtering Active Subdomains with HTTPX
cat subdomains_found.txt | httpx -title -status-code -o live_subdomains.txt
6. Automating with Recon-NG
recon-cli -m recon/domains-hosts/brute_hosts -d example.com -s brute_list=subdomains.txt
7. Using AltDNS for Permutation-Based Discovery
altdns -i subdomains.txt -o permutations.txt -w words.txt
What Undercode Say
Recon is not just about tools—it’s about strategy. Most hunters rely on default wordlists and public resolvers, leading to repetitive results. By customizing your approach (targeted wordlists, fresh resolvers, and automation), you uncover hidden attack surfaces.
Additional Linux & Windows Recon Commands
- Dig for Manual DNS Queries
dig @8.8.8.8 example.com ANY
- Nmap for Subdomain Port Scanning
nmap -iL live_subdomains.txt -p 80,443,8080 -oN nmap_scan.txt
- PowerShell DNS Enumeration (Windows)
foreach ($sub in Get-Content .\wordlist.txt) { Resolve-DnsName "$sub.example.com" -ErrorAction SilentlyContinue } - FFuF for VHost Discovery
ffuf -w subdomains.txt -u http://example.com -H "Host: FUZZ.example.com" -mc 200
Expected Output:
A refined list of live subdomains, open ports, and HTTP responses—ready for vulnerability assessment.
Further Reading:
References:
Reported By: Martinmarting How – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
