DEV Community 👩‍💻👨‍💻

Cover image for Wildcard Domains For Bug Bounties
darkmage
darkmage

Posted on

Wildcard Domains For Bug Bounties

A private bug bounty program I am on had a scope increase recently.
Many subdomains were extended in the form:

*target.com
Enter fullscreen mode Exit fullscreen mode

amass does not seem to have a feature that handles this sort of search, so I generated that list in bash/zsh:

for i in $(cat mylist.txt); do 
    echo $itarget.com >> potential-targets; 
done
Enter fullscreen mode Exit fullscreen mode

This is for only one target. If your list containing multiple targets is in targets.txt, do:

for i in $(cat targets.txt); do 
    for j in $(cat mylist.txt); do
        echo $j$i >> potential-targets.txt; 
    done
done
Enter fullscreen mode Exit fullscreen mode

This can yield a big file. To compress it after creation:

gzip -9 potential-targets.txt
Enter fullscreen mode Exit fullscreen mode

To zip them during creation:

for i in $(cat targets.txt); do 
    for j in $(cat mylist.txt); do
        echo $j$i | gzip -9 >> potential-targets.txt.gz; 
    done
done
Enter fullscreen mode Exit fullscreen mode

Once you've created the list of targets and zipped them, lets say we want to find all of the potentials yielding actual pages with content. Fire up httpx:

zcat potential-targets.txt.gz | \
httpx -no-fallback -o httpx.txt
Enter fullscreen mode Exit fullscreen mode

Because this can take a long time, you might consider lowering the timeout, or using more or less threads:

zcat potential-targets.txt.gz | \
httpx -no-fallback -o httpx.txt -threads 200 -timeout 1
Enter fullscreen mode Exit fullscreen mode

Lets say you didn't zip potential-targets. That's ok. httpx has an option to read directly from file. Everyone online is so obsessed with piping output because they think it is cool, but encouraging people to merely copy/paste data results in bad thinking and approach.

httpx -l potential-targets.txt -no-fallback \
-o httpx.txt -threads 200 -timeout 1
Enter fullscreen mode Exit fullscreen mode

This will run for a long time. I was running it with default timeout and 8 threads on 300,000+ possible names and it had not completed after several hours. I'm running it now on a much larger namespace and even though it is taking a long time, I am already yielding new names that did not show up in amass.


If this helps you at all, or you want to lurk for other content or whatever, here is my twitter

Top comments (0)

Take a look at this:

Settings

Go to your customization settings to nudge your home feed to show content more relevant to your developer experience level. 🛠