Enumerating subdomains with Burp Suite

You can use Burp Intruder to enumerate additional, hidden subdomains that are in scope but aren't explicitly linked from the initial set of domains you're testing. This enables you to discover additional access points and attack surface, including:

• Internal subdomains that shouldn't be publicly accessible.
• Subdomains that may have been forgotten about and therefore aren't regularly updated.

Steps

You can follow along with the process below using portswigger-labs.net, our deliberately vulnerable sandbox domain. To enumerate additional subdomains:

1. Send a request for the main domain you want to investigate to Burp Intruder. For example, http://portswigger-labs.net.
2. Go to Intruder. The request is displayed in a new attack tab.
3. In the Target field, add a placeholder subdomain. For example, http://x.portswigger-labs.net.

4. Highlight the placeholder subdomain and click Add § to mark it as a payload position.

   
5. In the Payloads side panel, under Payload configuration, add a list of potential subdomain names. If you are using Burp Suite Professional, you can select from a list of built-in wordlists. The Directories list is suitable in this case.
6. Click Start attack. An attack results window opens. Intruder sends a request for each payload in the list, with the payload in place of the placeholder subdomain.

7. Click the column headers to sort the responses. Identify any inconsistent items. For example, the response for http://staff.portswigger-labs.net has a different length from the other responses.

   
8. Right-click the subdomain you enumerated. Select Request in browser > In original session to copy a URL for the request.
9. Open Burp's browser and access the URL. For example, http://staff.portswigger-labs.net renders a login form.