Enumeration subdomain

wfuzz -c -f sub-finger -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u "http://cmess.thm" -H "Host: FUZZ.cmess.thm" --hc 302

cat << 'EOF' > /tmp/subdomain_fl.sh
#!/bin/bash
echo "TARGET: $1"
for sub in $(cat /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt); do 
  host $sub.$1 | grep -v 'not found';
done
EOF
chmod +x /tmp/subdomain_fl.sh

subdomain_fl.sh $URL

for ip_part in $(seq 0 254); do 
  host 51.222.169.$ip_part | grep -v 'not found';
done

gobuster dns -r $IP -d $URL -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt

dig $URL any

RUN apt-get install -y python-dnspython && \
    cd home && \
    curl -LOk -o knock.tar.gz https://github.com/guelfoweb/knock/archive/4.1.0.tar.gz && \
    mv 4.1.0.tar.gz knock.tar.gz && \
    tar -xzf knock.tar.gz && \
    rm knock.tar.gz && \
    cd knock-4.1.0 && \
    python setup.py install

RUN cd /home && \
    git clone https://github.com/aboul3la/Sublist3r && \
    cd /home/Sublist3r && \
    pip install -r requirements.txt && \
    ln -sf /home/Sublist3r/sublist3r.py /usr/local/bin/sublist3r

dnsenum $URL

theHarvester -d $URL -b all

# Brute force domains and hosts using a given dictionary.
dnsrecon -d $URL -D /usr/share/wordlists/subdomains-top1million-110000.txt -t brt
dnsrecon -d $URL -t bing
dnsrecon -d $URL -t yand
dnsrecon -d $URL -t crt