Domain Enumeration

SSL CertificatesCrt.sh

• Source of certificate transparency logs

Company Hosted Servers

• host command in linux

• for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done

Shodan

• can find surveillance cameras, servers, smart home systems, industrial controllers, traffic lights and traffic controllers

• for i in $(cat ip-addresses.txt);do shodan host $i;done

DNS records

• dig command in linux