ProfessionalCommunity Edition

Enumerating subdomains with Burp Suite

  • Last updated: January 29, 2024

  • Read time: 2 Minutes

You can use Burp Intruder to enumerate additional, hidden subdomains that are in scope but aren't explicitly linked from the initial set of domains you're testing. This enables you to discover additional access points and attack surface, including:

  • Internal subdomains that shouldn't be publicly accessible.
  • Subdomains that may have been forgotten about and therefore aren't regularly updated.

Note

The following technique is only possible in cases where the target domain has a wildcard DNS record. Burp Intruder is an extremely versatile tool and can be used for a variety of other purposes. For more information, see Typical uses for Burp Intruder.

Steps

You can follow along with the process below using portswigger-labs.net, our deliberately vulnerable sandbox domain. To enumerate additional subdomains:

  1. Send a request for the main domain you want to investigate to Burp Intruder. For example, http://portswigger-labs.net.
  2. Go to the Intruder tab. The request is displayed in a new attack tab.
  3. In the Target field, add a placeholder subdomain. For example, http://x.portswigger-labs.net.
  4. Highlight the placeholder subdomain and click Add ยง to mark it as a payload position.

    Set payload position
  5. Go to the Payloads tab. Add your list of potential subdomain names under Payload settings [Simple list]. If you are using Burp Suite Professional, you can select from a list of built-in wordlists. The Directories list is suitable in this case.
  6. Click Start attack. An attack results window opens. Intruder sends a request for each payload in the list, with the payload in place of the placeholder subdomain.
  7. Click the column headers to sort the responses. Identify any inconsistent items. For example, the response for http://staff.portswigger-labs.net has a different length from the other responses.

    Identifying inconsistent results
  8. Right-click the subdomain you enumerated. Select Request in browser > In original session to copy a URL for the request.
  9. Open Burp's browser and access the URL. For example, http://staff.portswigger-labs.net renders a login form.

Was this article helpful?