When an SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate is created for a domain by a CA (Certificate Authority), CA's take part in what's called "Certificate Transparency (CT) logs".
Bruteforce DNS (Domain Name System) enumeration is the method of trying tens, hundreds, thousands or even millions of different possible subdomains from a pre-defined list of commonly used subdomains.
dnsrecon -d example.com
OSINT - Sublist3r
Sublist3r tool is used to enumerate all the subdomains.
Use the below command to start finding the subdomains.
sublist3r.py -d example.com
Virtual Hosts
Some subdomains aren't always hosted in publicly accessible DNS results, such as development versions of a web application or administration portals.
Because web servers can host multiple websites from one server when a website is requested from a client, the server knows which website the client wants from the Host header.
We can utilize this host header by making changes to it and monitoring the response to see if we've discovered a new website.
