LazyRecon is now powered by Massdns and can pull way more subdomains than you think
Posted in Tool Discussion by @plenum



Hello everyone, I wanted to share with you a custom version of @nahamsec lazyrecon, this version uses multiple sources to scrape and bruteforce subdomains. The script uses Sublist3r, certspotter, crt.sh and massdns to find subdomains and report possible ns subdomain takeovers. More info can be found at https://github.com/plenumlab/lazyrecon

Happy hunting.

Posted on 2018-11-19