All right, so some find out the next best discovery tool when it comes to the means, and you can see
it useful for bounties and penetration testing.
So we can look down here and you can see, you know, much different options, the features.
You see what you can do.
You've got passive sources to maximize results, optimize the speed.
But the real benefit from some finder comes with its training capability.
So you go up here, you go to usage.
You could just run it this way.
Right?
Find the domain.
But we're really we're just one that's really shines is here when you echo domain into supply under
the output that EDP.
So basically what you're saying is, all right, we're going to get to the next lecture, but you can
say, OK, I want to find all the subdomains on one.
Parcelling disappoint her, don't print the banner, just give me the results and then take the results
of each of these returned from the finder and pipe them into HTP X to see if they're alive.
Right.
Because just because you get a domain back doesn't mean it's still active.
This is a really, really nice workflow.
But I want to show you how to set this up as a couple of ways.
Right.
You can use Docker.
You know, I've tried all these methods and really the easiest is just to set it up using go so you
can see when you go installed in order to run this or some other feeds that you can use if you don't
have the API keys for these sources, you won't get results back from them.
You technically don't need the API keys for these sources in order to get value from this tool.
So let's just go ahead and jump into it.
Let me show you something else here.
If you lose your team, Successional, you lose your SFH.
Let's clean it out.
Right.
If I SFH back in, you'll notice I don't have anything related to Tmax.
But if I do Tmax, unless you can see there's a session called bounty and everything to do with type
two mux attach and it comes back precourt control.
X causes pain control.
X causes pain joy x close that pain exit step finder controls the till z to kill that clear.
Let's start fresh.
All right, let's give it a go.
Now this only works because we have go install installed.
So if you're running into issues, make sure you go back to the lesson where I talk about installing
go and let's see if we have sublinear now we do see it's green.
That is an auspicious sign.
So if we do find our tech Dakich we get to help control a single quote and then we can look at some
of the things we can do here so we can read Zero Zip Finder and we give her on the Dashty to find the
subdomains for this domain.
So D'Asti Papabile dot com and what else.
We could list all available sources, but we don't need to do that.
We already know those sources.
Tacho file right output too.
So we do want to do that.
Let's go back up.
Silence is good if you're passing the finder into another tool like HTP X, because it would only output
the subdomains and you can easily Pipestone subdomains into another tool to test that those domains
are active Tactix.
This will give you the option to modify the number of concurrent threads.
You don't want to overwhelm the server.
If you're inundated with too many threads, then well, you might get bad or you might just knock over
the server.
So you want to be polite when you're doing a bug bounty and everything else looks pretty good.
So our press enter
and you'll know the finder is really, really fast, so this is the trade off, right?
So Pinder's quick imasu, slow Ima's as thorough in some finder, isn't as comprehensive.
But when you combine both with their disparate threat intelligence feeds, you concatenate their their
results together.
You have an awesome, awesome file that you can use to, you know, pass to a tool like HTP Probe by
Tom Numnah or HTP X, which is what we're going to do next.
So let's let these results come back and then we'll we'll take a look at the results, the output right
to the finish pretty quickly.
We can do PayPal dot.
Clean that him, as you can see, we've got.
1437 files there and the other one,
we have three thousand four hundred ninety one.
So what we're going to do is concatenate both together, right?
We can do is you look at people that clean that Ima's people, dotcom that her.
Now, if we do that, this is the blending of both.
Everything looks good.
But I do want to make sure that we don't have any leading bases in one of the ways you can do that,
really, by using the translate tool.
You can see if we do blink here, it'll match an all horizontal white space.
Which is what we want.
We'll the daddy to delete horizontal white space for the translate or delete characters to write you
a quick translate delete
and it's going to look the same.
We didn't really change anything there, but we're going to pipe it into people that clean, actually,
we'll just call it combined.
There we go.
And now.
Combined has everything in it.
This is exactly what we wanted.
Now, if we are unique, it we still have the same amount.
So I just wanted to make sure we didn't have any duplicates between both and we don't.
So in the next lecture, what we'll do is we'll paint this over and we'll get a list of all of the things
that are actually valid.
Right.
So I will see you in the next lecture.