Domain Fuzzing

# add domain to etc/hosts
sudo sh -c 'echo "Server_IP domain.htb" >> /etc/hosts'

#search for domains using seclists dns > subdomains
ffuf -w /path/to/subdomains.txt:FUZZ -u https://FUZZ.domain.com/

#scan for vhosts if there are no public subdomains (look for different response sizes)
ffuf -w /path/to/subdomain.txt:FUZZ -u http://domain.com:port/ -H 'HOST:FUZZ.domain.com'

#to filter out specific codes use '-fs 900'
ffuf -w /path/to/subdomain.txt:FUZZ -u http://domain.com:port/ -H 'HOST:FUZZ.domain.com' -fs 900