Skip to main content

Subdomain enumeration

FFUF​

 ffuf -w /usr/share/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt \
 -u http://example.tld -H "Host:FUZZ.example.tld" -fs 169

Gobuster​

gobuster dns -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -d example.tld

FFUF seems to be working better than Gobuster in most cases.