Now we're going to be installing a tool called asset finder so in previous videos we use sub Lister
to find subdomains.
It's okay.
It was good when it first came out and it was ahead of its time honestly but now it's kind of it's just
all right and there's better tools out there and I want to introduce you to those so asset finder is
a great tool at finding subdomains.
So we're gonna go ahead and just type an asset finder and we should be finding Tom nom nom here.
Tom is a great guy.
He's a great programmer great bug bounty hunter.
He makes awesome tools asset finder is one of them.
So go ahead and just click on asset finder and scroll down and we're gonna do is or is going to highlight
this.
Copy it and we're going to open up a terminal and all we've got to do is paces in the terminal hit enter
and now asset finder should be installed.
You start typing it and then just tab asset finder is there.
So let's take a look at what asset finder can do.
So if we say asset finder and we say Tesla dot com OK look how fast that worked.
Let's actually let's put this to a file let's just call this Tesla sub subs don t t and it's quick and
then we can cap Tesla subs that t t and we can just say word count and we'll do a dash alt account.
Three hundred and forty seven.
All right.
And.
OK.
There are some repeats as you can see here so it's not going to be completely unique but still three
hundred and forty seven really fast.
Now the one thing that this is doing is it is not just it's not taking out only the subs right.
So you could see if we look through here there's like Berkeley dot to you.
It's also finding assets related to Tesla or that should or might be owned by Tesla.
However we don't always want this in here.
So what we can do is we could say asset finder subs only so only if it's related to that subdomain Tesla
dot com and that will pull down only related to it.
Now what I have actually found is that it's better to run asset finder like this and then later grep
out the subdomains.
So that's my opinion.
And let's start writing a tool that's going to do this for us.
So I'm going to open a new tab or we're going to automate as we go.
So here's what we're gonna do.
We're gonna say get it and we're just gonna call this run by s age and the first thing we're gonna do
here is where it is going to shebang.
Bin bash and I want to declare a variable of your URL because that's what we're gonna be providing and
we'll make your URL equal to dollar sign 1 meaning the first argument.
OK.
And what we're gonna do is we're going to say we're going to use asset finder so let's let's make a
couple tabs down here and we're just gonna say echo and we can make this pretty something like this
will say harvesting subdomains with asset finder.
OK.
And then we can just declare what we're gonna do is we're gonna say asset finder and you are L and now
I want to put this in to a folder so let's make it for the URL and let's actually let's call this let's
call it recon and we'll call this file assets dot tag.
So we're gonna put everything in the assets dot text.
Now the issue here is we don't have a folder called recon nor do we have a folder for our your l.
So we have to make that.
So the easy way to do this is to make an if statement that looks something like this.
We can say if and then we could say does not have a folder ok.
Of your URL then we're gonna go ahead and just make that folder.
So we'll say then and then we're gonna go ahead and just say make sure of yourself.
So the directory doesn't exist of our your URL.
We're gonna go ahead make it and guess what.
If the directory does not exist of you are L and then recon we're gonna go ahead and just make that
as well.
So let's say then make dir your l recon and then.
And if there so that's the first part.
So we're going to we're gonna take asset finder and we're going to look for the assets.
Now we only want subs in here.
Right.
Only the subdomains related to our scope.
We don't want to go out of scope.
So if our client is Tesla dot com then we want to stay in Tesla dot coms subdomains.
So what can we do here.
Well we can go ahead and sort this out so we can say something like cat and we'll say you are L recon
assets that text and we're going to just graph out dollar sign 1.
So whatever we put in there Tesla dot com we're only going to grep out what's in there which is Tesla
dot com or we could do a graph of your.
All right let's put this into something like this.
We'll put it into a new document we'll call it recon and we'll call it final text just like this.
OK.
And we'll go ahead and just remove the file we just created which was your l recon assets that text
and then we should have a final that text stored in that folder.
So all we've done so far is make a couple directories and then we're going to hit gonna go ahead and
run asset finder.
We're gonna put it all into assets dot text and then we're going to sort that out put it into final
text and remove assets.
Tax let's save this and let's go ahead and just run this and what we'll do is it should make the folder
here for recon for it.
So I'll ask just to prove concept that it's not here as of right now.
And then what we're gonna do is we're just going to say see h my plus X on run dot SDH run the s h age
and we'll say Tesla dot com line 3 command not found I messed up here.
Apologies C I am I'm terrible sometimes at this you're out equals dollars sign 1 OK let's control see
this let's try running it one more time.
There we go.
So this will attempt now to run and harvest this if we Ellis We should have the folder here for Tesla
dot com which we do you see Tesla dot com if we see into Tesla dot com slash recon we l s and here we
have final that text which let's just get it to make it easier and we come through here and now everything
is related to Tesla dot com we don't see anything in here that's not Tesla dot com OK and we're still
gonna have potential repeats we'll get rid of that as the script goes on but for now we have all of
these subdomains available to us now we're going to have to take the next step from here and improve
upon this to find what's actually out there and alive.
So let's go ahead and do that in the next video.