Ready to Start Your Career?

Practical Web Application Penetration Testing Series - Chapter 2

Babak Esmaeili's profile image

By: Babak Esmaeili

September 29, 2016


In the first chapter we saw how to detect and recon the technology of a website. Now, in chapter 2 we are going to use website or for detecting the sub-domains of a website and information gathering.

In Google, we use the query site:* or site:*

For instance if we want to find sub-domains of with google, we would use the query site:*, see the picture below:

As you can see, there are many sub-domains like:, and others.

A good penetration tester always checks all sub-domains for vulnerabilities. Even if they are not on the same network, they could contain useful information.

Another way for finding sub-domains and other useful information online, is to use these sites: and

I used for the following demonstration: 


On the third table we hit sub-domains to see all sub-domains of the site:


Just as easy as that.

Another thing we should consider is the Reverse ip lookup. What is reverse ip lookup? It is used to find all sites hosted on a given server. For example on one server, we  could have 2 or more web applications hosted on the same IP (see the demonstration for site for example).

reverse ip.png

The hint is if we find any vulnerability in other web applications hosted on that IP, we may be able to pawn the others. For example, we find SQL Injection on one of the domains and when we hack in to database, we also find other domains' database information in that.

If we want to find sub-domains in Kali Linux we can use the command: fierce -dns <domain name>

I personally prefer using online tools because my IP remains safe from IDS and firewalls and it does not get blacklisted ;) In my experience the sub-domains have a greater possibility to have vulnerabilities as the programmers usually don’t pay much attention on the security terms of the sub-domains because the sub-domains are usually less interactive with users.

Anyway, in our case we are not going to test all sub-domains but instead just test this sub-domain:

In the next chapter we will start using Burpsuite ….


Schedule Demo