How to use the command 'sublist3r' (with examples)

Sublist3r is a powerful and efficient tool designed for penetration testers and security researchers to enumerate subdomains of websites. This utility harnesses multiple sources to expedite and enhance the subdomain discovery process. By automating what would otherwise be a time-consuming manual task, Sublist3r assists in uncovering minor and often overlooked entry points that could be exploited during a security assessment.

Use case 1: Find subdomains for a domain

Code:

sublist3r --domain example.com

Motivation:

In the ever-evolving landscape of cybersecurity, subdomain enumeration is a crucial step in understanding the breadth of an organization’s digital presence. Finding subdomains for a domain is particularly important for penetration testers and security analysts engaged in reconnaissance. By identifying subdomains, you can uncover additional services and endpoints potentially vulnerable to attack. This process also reveals the structure and scale of a company’s web environment and may lead researchers to old or neglected areas of an organization’s network.

Explanation:

• --domain: This argument specifies that Sublist3r should focus on a single primary domain, in this case, example.com. The domain is pivotal as it narrows down the search field to only those subdomains under it.

Example output:

[+] Enumerating subdomains now for example.com
[+] Found subdomain: www.example.com
[+] Found subdomain: mail.example.com
[+] Found subdomain: blog.example.com
[+] Found subdomain: dev.example.com

Use case 2: Find subdomains for a domain, also enabling brute force search

Code:

sublist3r --domain example.com --bruteforce

Motivation:

Brute force searching for subdomains is an advanced tactic used by penetration testers who want to ensure a comprehensive subdomain enumeration. While basic enumeration techniques rely on public databases and search engines, brute force takes a more aggressive approach by systematically guessing subdomain names. This increases the chances of finding hidden or obscure subdomains that may not appear in public records, revealing more potential portals for malicious exploitation or testing.

Explanation:

• --domain: This tells Sublist3r to investigate subdomains specifically associated with example.com.
• --bruteforce: This option enables an exhaustive search methodology aimed at discovering subdomains by trying a multitude of possible subdomain names, increasing the coverage of the enumeration process.

Example output:

[+] Enumerating subdomains now for example.com with brute force
[+] Found subdomain: admin.example.com
[+] Found subdomain: secret.example.com
[+] Found subdomain: test.example.com

Use case 3: Save the found subdomains to a text file

Code:

sublist3r --domain example.com --output subdomains.txt

Motivation:

Saving the discovered subdomains to a text file is an organizational and analytical step that enables security professionals to document and later review their findings. It facilitates easier sharing and reporting, especially within teams, providing a clear itemization of potentially exploitable or vulnerable access points. When managing vast or repeated assessments, this functionality is invaluable for tracking changes or new findings over time.

Explanation:

• --domain: This argument instructs Sublist3r to focus on example.com.
• --output: This option specifies a file path, in this example subdomains.txt, where the results should be saved. It is crucial for archiving and subsequent evaluation of the collected subdomain data.

Example output:

[+] Enumerating subdomains now for example.com
[+] Writing results to subdomains.txt

After running the command, you would find a file named subdomains.txt in your specified directory with contents similar to:

www.example.com
mail.example.com
blog.example.com
dev.example.com

Use case 4: Display help

Code:

sublist3r --help

Motivation:

Accessing the help menu is a fundamental step for new users of a tool, as it provides an overview of all available options and functionalities. This establishes a foundation of understanding regarding the tool’s capabilities, arguments, and usage patterns. It is also beneficial for experienced users as a quick reference guide to ensure they are utilizing the tool correctly and efficiently.

Explanation:

• --help: This switch triggers the display of Sublist3r’s help documentation, detailing the function and syntax of each available command-line argument, thus aiding the user in selecting the most appropriate options for their specific needs.

Example output:

Usage: sublist3r.py [OPTIONS]

Options:
  --domain        Domain name to enumerate subdomains of.
  --bruteforce    Enable brute force subdomain enumeration.
  --output        Save the output into the specified file name.
  --help          Show this message and exit.

Conclusion:

By using Sublist3r, security professionals can efficiently enumerate subdomains and enhance their understanding of potential attack surfaces. Each use case demonstrates how versatile and valuable this tool is in the security testing process. Whether you are simply exploring a domain’s structure, employing brute force techniques for deeper insights, saving results for later analysis, or just getting started with the tool, Sublist3r provides robust functionality for a variety of cybersecurity contexts.