Sublist3r

This account was spamming Python repositories with the same type of low value obvious backdoor spam.[1] Full list of attempted pull requests (all deleted seemingly by GitHub): 1 https://www.github.com/KurtBestor/Hitomi-Downloader/pull/7638 2 https://www.github.com/home-assistant/core/pull/130423 3 https://www.github.com/celery/celery/pull/9407 4 https://www.github.com/chriskiehl/Gooey/pull/921 5 https://www.github.com/crewAIInc/crewAI/pull/1582 6 https://www.github.com/cumulo-autumn/StreamDiffusion/pull/177 7 https://www.github.com/AUTOMATIC1111/stable-diffusion-webui/pull/16646 8 https://www.github.com/Aider-AI/aider/pull/2343 9 https://www.github.com/aboul3la/Sublist3r/pull/383 10 https://www.github.com/plotly/dash/pull/3073 11 https://www.github.com/soimort/you-get/pull/3034 12 https://www.github.com/streamlink/

You cannot hide anything on the internet anymore, the full IPv4 range is scanned regularly by multiple entities. If you open a port on a public IP it will get found. If it's a obscure non-standard port it might take longer, but if it's on any of the standard ports it will get probed very quickly and included tools like shodan.io The reason why I'm repeating this, is that not everyone knows this. People still (albeit less) put up elastic and mongodb instances with no authentication on public IP's. The second thing which isn't well known is the Certificate Transparency logs. This is the reason why you can't (without a wildcard cert) hide any HTTPS service. When you ask Let's Encrypt (or any CA actually) to generate veryobscure.domain.tld they will send that to the Certificate Transparency logs. You can find every certificate which was mint

Sublist3r [1] does a similar job, as long as you have the authorisation to use it on a particular domain, as it uses more aggressive discovery techniques. [1] https://github.com/aboul3la/Sublist3r

Check Google, Bing, Virustotal, Parse HTTPS Certificates including the metadata (Censys.io is great for specific queries), subdomain bruteforce with a good wordlist, download source code found in Github and regex search for HTTP urls, then parse them. Now don't do it by hand people have already built tools. I recommend sublist3r https://github.com/aboul3la/Sublist3r, however, grab other subdomain bruteforcer wordlists and append them all together. Go to https://opendata.rapid7.com/, download the reverse DNS and Forward DNS and grep for your domain. I.E grep "*.mydomain.com" These are amazing. I will make a note, sometimes if you are looking for servers related to a company specifically people miss ones that aren't in a company's zone file. You need to use a service like Shodan or Censys which regularly scan the internet and index these. I

These will find your droids. sublist3r https://github.com/aboul3la/Sublist3r amass https://github.com/caffix/amass subfinder https://github.com/subfinder/subfinder

Ah, the classical network pentester's problem. There's really no one good way to go about this. Certificate transparency tools like CTFR (https://github.com/UnaPibaGeek/ctfr) work only if certs are registered. You could go old school and use a tool like Sublist3r (https://github.com/aboul3la/Sublist3r) or Punter (https://github.com/nethunteros/punter), but ymmv as API endpoints are savvy to these tools and actively work to snub them out. AXFR queries can be useful if the DNS server allows for it (my experience: 0-15). Best of luck.