Hacking Beyond.com , — Enumerating Private TLDs

This article details the creation of tldfinder, a tool to enumerate TLDs and related domains discovered during a red team engagement. It explains why TLD discovery is underserved, how data sources and APIs are used, and collaboration with ProjectDiscovery.

Keypoints

Red team assessment for a major retail company identified that the client owned its own top-level domains (TLDs) during OSINT.
TLD enumeration is underexplored compared to subdomain enumeration in current tooling.
Introduced tldfinder, a tool with three discovery modes: DNS, TLD, and Domain.
tldfinder queries multiple data sources via APIs to discover domains and associated TLDs, including some sources requiring API keys.
Demonstrated practical data sources (e.g., crtsh, Netlas) and discussed which sources support domain enumeration vs. only other features.
Released tldfinder in collaboration with ProjectDiscovery and highlighted how to configure provider keys for better results.

MITRE Techniques

[T1593] OSINT Collection – Used open-source reconnaissance to gather information about TLDs. “Utilized open-source reconnaissance to gather information about TLDs.”
[T1483] Domain Generation Algorithms – Explored methods for domain enumeration based on TLDs. “Explored methods for domain enumeration based on TLDs.”
[T1071] Application Layer Protocol – Used APIs to query for domain information. “Used APIs to query for domain information.”

Indicators of Compromise

[Domain] Discovery results from DNS/TLD enumeration – google, partners.cloudskillsboost.google, and 46 more
[TLD] Observed TLDs referenced in examples – .google, .xn--fiq228c5hs