swtornio / subdomain_enum

Originally written to enumerate Azure cloud domains, although the domains and permutations arguments could be applied to any dns enumeration.

Based on MicroBurst from NetSPI - https://github.com/netspi/microburst Swiped the permutations.txt and the list of subdomains from there.

Wrote my own because the ps1 file was super slow in my Windows VM and it's quicker for me to write python than to understand powershell.

(.env) danny@Dannys-MBP subdomain_enum % python ./subdomain_enum.py -h
usage: subdomain_enum.py [-h] [--base BASE] [--permutations PERMUTATIONS] [--domains DOMAINS] [--outfile OUTFILE]

Enumerate Azure Cloud resources

optional arguments:
  -h, --help            show this help message and exit
  --base BASE           Base word
  --permutations PERMUTATIONS
                        File containing permutations
  --domains DOMAINS     File containing domains
  --outfile OUTFILE     Output file

  (.env) danny@Dannys-MBP subdomain_enum % python ./subdomain_enum.py --base test --outfile out.txt
Exists but no IP for apitest.onmicrosoft.com
Exists but no IP for azuretest.onmicrosoft.com
Exists but no IP for testazure.onmicrosoft.com
Exists but no IP for cheftest.onmicrosoft.com
Exists but no IP for clienttest.onmicrosoft.com
Exists but no IP for testclient.onmicrosoft.com
Exists but no IP for configtest.onmicrosoft.com
Exists but no IP for testconfig.onmicrosoft.com
<...snip...>
Exists but no IP for testsplunk.onmicrosoft.com
Exists but no IP for sshtest.onmicrosoft.com
Exists but no IP for stagingtest.onmicrosoft.com
Exists but no IP for storagetest.onmicrosoft.com
Exists but no IP for testtest.onmicrosoft.com
Exists but no IP for testtest.onmicrosoft.com
Exists but no IP for testtmp.onmicrosoft.com
Exists but no IP for westustest.onmicrosoft.com
Exists but no IP for testweb.onmicrosoft.com
Exists but no IP for imgtest.onmicrosoft.com
test.onmicrosoft.com exists
apitest.scm.azurewebsites.net exists
testapi.scm.azurewebsites.net exists
api-test.scm.azurewebsites.net exists
test-api.scm.azurewebsites.net exists
assetstest.scm.azurewebsites.net exists
azuretest.scm.azurewebsites.net exists
testazure.scm.azurewebsites.net exists
azure-test.scm.azurewebsites.net exists
test-azure.scm.azurewebsites.net exists
chef-test.scm.azurewebsites.net exists
clienttest.scm.azurewebsites.net exists
testclient.scm.azurewebsites.net exists
test-client.scm.azurewebsites.net exists
<...snip...>