Realizando Enumeração de Subdomínios com Subfinder

Quando Usar

• Durante a fase de reconhecimento de testes de penetração ou caça a bugs (bug bounty hunting)
• Ao mapear a superfície de ataque externa de uma organização alvo
• Antes de realizar varreduras de vulnerabilidade em subdomínios descobertos
• Ao construir um inventário de ativos para monitoramento contínuo de segurança
• Durante engajamentos de equipe vermelha (red team) que exigem coleta passiva de informações

Pré-requisitos

• Go 1.21+ instalado para compilação a partir do código fonte
• Subfinder v2 instalado (go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest)
• Chaves de API configuradas para fontes passivas (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)
• Arquivo de configuração de provedores em $HOME/.config/subfinder/provider-config.yaml
• Acesso à rede para fontes de DNS passivo e transparência de certificados
• httpx ou httprobe para validar subdomínios descobertos

Fluxo de Trabalho

Passo 1 — Instalar e Configurar o Subfinder

# Install subfinder
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Verify installation
subfinder -version

# Configure API keys for enhanced results
mkdir -p $HOME/.config/subfinder
cat > $HOME/.config/subfinder/provider-config.yaml << 'EOF'
shodan:
  - YOUR_SHODAN_API_KEY
censys:
  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET
virustotal:
  - YOUR_VT_API_KEY
securitytrails:
  - YOUR_ST_API_KEY
chaos:
  - YOUR_CHAOS_API_KEY
EOF

Passo 2 — Executar Enumeração Básica de Subdomínios

# Single domain enumeration
subfinder -d example.com -o subdomains.txt

# Multiple domains from a file
subfinder -dL domains.txt -o all_subdomains.txt

# Use all passive sources (slower but more thorough)
subfinder -d example.com -all -o subdomains_all.txt

# Silent mode for piping to other tools
subfinder -d example.com -silent | httpx -silent -status-code

Passo 3 — Filtrar e Personalizar a Seleção de Fontes

# Use specific sources only
subfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt

# Exclude specific sources
subfinder -d example.com -es github -o results.txt

# Enable recursive subdomain enumeration
subfinder -d example.com -recursive -o recursive_subs.txt

# Match specific patterns
subfinder -d example.com -m "api,dev,staging" -o matched.txt

Passo 4 — Controlar Limitação de Taxa e Formato de Saída

# Rate limit to avoid API throttling
subfinder -d example.com -rate-limit 10 -t 5 -o rate_limited.txt

# JSON output for programmatic processing
subfinder -d example.com -oJ -o subdomains.json

# Output with source information
subfinder -d example.com -cs -o subdomains_with_sources.txt

# Collect results in a directory per domain
subfinder -dL domains.txt -oD ./results/

Passo 5 — Validar Subdomínios Descobertos com httpx

# Pipe subfinder output to httpx for live validation
subfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect -o live_hosts.txt

# Check for specific ports
subfinder -d example.com -silent | httpx -ports 80,443,8080,8443 -o web_services.txt

# Resolve IP addresses
subfinder -d example.com -silent | dnsx -a -resp -o resolved.txt

Passo 6 — Integrar com Pipeline de Reconhecimento Mais Amplo

# Chain with nuclei for vulnerability scanning
subfinder -d example.com -silent | httpx -silent | nuclei -t cves/ -o vulns.txt

# Combine with amass for comprehensive enumeration
subfinder -d example.com -o subfinder_results.txt
amass enum -passive -d example.com -o amass_results.txt
cat subfinder_results.txt amass_results.txt | sort -u > combined_subdomains.txt

# Screenshot discovered hosts
subfinder -d example.com -silent | httpx -silent | gowitness file -f - -P screenshots/

Conceitos Chave

Ferramentas & Sistemas

…