Hello, everyone, and welcome to this video.
So in this video, we are going to see what of the tool, which is useful to identify subdomain because
so after you have identified subdomains for any target program, you just need to supply all your subdomains
to this tool and it will automatically identify the subdomain, takeover vulnerability for you.
So how to do it?
First of all, you need to download and install this tool, which is a subzy.
You can also clone this or you can download a zip from here and do the further installation.
If you do not want to do the installation manually, you can also install it with the help of Go
as a tool is created and go.
So for the installation, you just need to copy these two lines, which is go get and go install.
Remember, for this, you need to have the go lang installation into your computer, which is a prerequisite.
So after you just copy paste this into your terminal, you will be able to successfully install the
subzy tool.
Now, in case you come across any errors year, it has clearly shown how to set your go path for
each Shell environment.
For example, if you are running bash,zsh, fish windows, etc., you can just copy paste these
commands into your terminal and it will do the job for, you know, as I'm running the zsh.
So I'm going to copy paste the above commands, which are this into my terminal and it will successfully
export the go path for me.
I have already done it, but I'm going to show you how to do it for this.
You just need to go to your terminal and copy paste the.
Command.
As you can see, I'm running a Z S.H. So I have pasted this command and now the go path has been successfully
exported.
Perfect.
Now you can just copy paste those two commands, which was go get and go install.
subzy should automatically get installed for your system without any issues
Now you can just verify if the installation has been done or no.
by typing the command, which is a subzy and you should get a help menu like this.
Perfect.
So we have successfully installed the tool.
Now it's time to test the tool to identify if it works or not.
So you can see your other options to use this tool.
The first one is target.
In case you want to scan only one target, then you can give the option, which is subzy space hyphen target
target.
You can also give multiple targets by Comma.
As you can see over here, if you want to give a list of subdomains or target from any file, then you
can just pass the path of the file and it will start scanning all the target domains or subdomains from
that specific path.
But you can also increase the concurrency.
Concurrency means the number of default checks or you can see thread's.
It will make a process much more faster, hide fails means.
You do not want to see which ones are failing, which means not vulnerable you only want to see and is
interested in, which is vulnerable.
Alright, so let's quickly test this.
So I have made a file which is sites.txt, which contains all the subdomains.
So I have enumerated these subdomains from my website, which is srscure.xyz.
So now I'm going to type the command, which is sabzy space //.
Target sites dot txt as you can see over here now, I'm also going to use the concurrency flag to increase
the concurrency, which is the threat to get faster responses by default.
It uses ten threads.
I'm going to use twenty and you can see it has started scanning.
Now, this output is given by the tool, which is find domain.
So you can see these are all the verbose messages that it gives.
And it is this tool is trying and saying https error.
OK, moving ahead, you can see Apple.srscure.xyz is not vulnerable
stko.srscure.xyz is not vulnerable but redmik20.srscure.xyz
is vulnerable and you can see it is pointed to Shopify.
Perfect.
So we have identifieda vulnerable domain which is being pointed to Shopify but have not been claimed.
We have identified more domains, which is varshclothestores.srscure.xyz which
is.
Again, pointing to Shopify.
Now, let's say we do not want to see all such noise onto our terminal and we are only interested in
seeing those particular output which are vulnerable and again, simply type hide, underscore fails,
and you will be able to see only those targeted subdomains like you can see, which are vulnerable.
So let's confirm this.
If it is vulnerable or no going to the Incognito browser, we can see the target is successfully vulnerable.
So I hope you guys understood how you can install this tool.
How can you supply your list with the subdomains and identify if the target is vulnerable or no.
Thank you.