Hello team,
Is it possible to do subdomain discovery with OpenVAS?
I was not able to find any VTs for this purpose. However, that doesn’t mean there isn’t one, but I don’t think there is…
You could look at the subfinder package. I think that finding subdomains relies on enumerating possible subdomains or collecting them from available internet links. To my knowledge, there is no way to query the DNS system to provide a list of all A/AAAA records with the same TLD.
Hello,
and welcome to this community forums.
The openvas-scanner is a classical automated network based vulnerability scanner and such functionality like enumerating additional subdomains is not in the scope of the scanner.
Subdomain enumeration is usually more a topic for penetration testing and bug bounty hunting for which dedicated tools like mentioned previously exists.
3 Likes