Web Application Penetration Testing Cheat Sheet

Re:Web Application Penetration Testing Cheat Sheet by MobutuPehuenche on Monday April 02, 2018 @04:01AM (#16733054)

"The search relies on data from our crawls of the Alexa Top 1 Million sites, Search Engines, Common Crawl, Certificate Transparency, Max Mind, Team Cymru, Shodan and scans.io."

So probably CT logs.

Also, if you've ever sent a cold-cache query to a recursive resolver that didn't employ QNAME minimization (few do), it was likely harvested by pDNS replication at the TLD nameserver level and shared with a number of commercial and research parties' databases to which DNSDumpster may subscribe.

[ Parent | on HN ]

Re:Web Application Penetration Testing Cheat Sheet by sbarre on Monday April 02, 2018 @07:53AM (#16733795)

This seems like the most likely candidate then (a resolver that caches and shares requests or CT - which I didn't know about), because the subdomain is a random string of characters so it wouldn't have been brute-forced.

Thank you for the insights!

[ Parent | on HN ]