Bounty Hunt Steps

Subdomain Enumeration Methodology

🎯 Objective

Identify valid sub-domains of the target domain to help build a complete picture of the attack surface.

🔍 Subdomain Scraping

Tool - Sublist3r

• Details: Python tool for subdomain enumeration via OSINT. Uses multiple search engines & services.
• Goal: Gather subdomains from public sources.
• Download:
  bash Copy

  sudo git clone https://github.com/aboul3la/Sublist3r.git

• Install:
  bash Copy

  sudo pip install -r requirements.txt

• Run:
  bash Copy

  sudo python3 sublist3r.py -d shopify.com -t 50 -o sublist3r.Shopify.txt -v
  cat sublist3r.Shopify.txt | xclip -i -selection clipboard

Tool - Amass

• Details: OWASP Amass for external asset discovery.
• Goal: Map attack surface and discover subdomains.
• Install:
  bash Copy

  apt-get install amass

• Run (Passive):
  bash Copy

  amass enum --passive -d shopify.com -o Shopify.txt

• Run (Active):
  bash Copy

  amass enum -src -ip -brute -min-for-recursive 2 -d shopify.com -o amass.Shopify.txt

Tool - Assetfinder

• Details: Fast domain & subdomain finder by Tomnomnom.
• Install:
  bash Copy

  go get -u github.com/tomnomnom/assetfinder

• Run:
  bash Copy

  assetfinder --subs-only shopify.com > assetfinder.Shopify.txt

Tool - GetAllUrls (gau)

• Details: Fetches URLs from AlienVault OTX, Wayback Machine, Common Crawl.
• Install:
  bash Copy

  GO111MODULE=on go get -u -v github.com/lc/gau

• Run:
  bash Copy

  gau -subs shopify.com | cut -d / -f 3 | sort -u > gau.Shopify.txt

🔗 Link / JS Discovery

Tool - GoSpider

• Details: Fast web spider written in Go.
• Install:
  bash Copy

  go get -u github.com/jaeles-project/gospider
  apt-get install golang

• Run:
  bash Copy

  gospider -s "https://shopify.com/" -o gospider.Shopify.txt -c 10 -d 1

Tool - Hakrawler

• Details: Go-based web crawler for endpoint & asset discovery.
• Install:
  bash Copy

  go get github.com/hakluke/hakrawler
  apt-get install golang

• Run:
  bash Copy

  cat Shopify.txt | ./hakrawler -subs -d 3 -u > hakrawler.Shopify.txt

Tool - SubDomainizer

• Details: Finds hidden subdomains, S3 buckets, Cloudfront URLs in JS/webpages.
• Install:
  bash Copy

  git clone https://github.com/nsonaniya2010/SubDomainizer.git
  pip3 install -r requirements.txt

• Run:
  bash Copy

  python3 SubDomainizer.py -u shopify.com -o subdomainizer.Shopify.txt

💣 Subdomain Bruteforcing

Tool - PureDNS

• Details: High-performance brute forcer using resolvers.
• Run:
  bash Copy

  puredns bruteforce 2m-subdomains.txt shopify.com resolvers.txt -w shopify.txt

Tool - ShuffleDNS

• Details: Wrapper around massdns for brute forcing.
• Install:
  bash Copy

  GO111MODULE=on go get -v github.com/projectdiscovery/shuffledns/cmd/shuffledns

• Run:
  bash Copy

  shuffledns -d shopify.com -w ~/Wordlists/all.txt -r ~/Wordlists/resolvers.txt

Build a Custom Wordlist (CeWL)

• Details: Spider websites to build wordlists.
• Run:
  bash Copy

  cewl -d 2 -m 5 -a -w ~/Wordlists/custom.txt https://shopify.com

🌐 Server/Port Enumeration

Tool - Dnmasscan

• Details: Scans AWS IP ranges, extracts TLS certs.
• Run:
  bash Copy

  python3 clear_sky.py -d shopify.com

Tool - Identify Web Servers

• Details: Parse dnmasscan output to find web servers.
• Run:
  bash Copy

  python3 wind.py -d shopify.com

📊 Final Analysis

Build List of Unique Subdomains

Consolidate results from all tools:

cat *.Shopify.txt | sort -u > consolidated.Shopify.txt

Check Subdomain Status with httprobe

• Install:
  bash Copy

  go get -u github.com/tomnomnom/httprobe

• Run:
  bash Copy

  cat consolidated.Shopify.txt | httprobe > httprobe.Shopify.txt

Identify Web Servers with EyeWitness

• Install:
  bash Copy

  git clone https://github.com/FortyNorthSecurity/EyeWitness.git
  cd EyeWitness/Python/setup && sudo ./setup.sh

• Run:
  bash Copy

  ./EyeWitness.py -f httprobe.Shopify.txt

✅ Outcome

• Enumerated subdomains using multiple scraping and brute force tools.
• Consolidated results into a unique list.
• Verified live servers with httprobe.
• Captured screenshots and server info with EyeWitness.