This article details the creation of tldfinder, a tool to enumerate TLDs and related domains discovered during a red team engagement. It explains why TLD discovery is underserved, how data sources and APIs are used, and collaboration with ProjectDiscovery.
Keypoints
- Red team assessment for a major retail company identified that the client owned its own top-level domains (TLDs) during OSINT.
- TLD enumeration is underexplored compared to subdomain enumeration in current tooling.
- Introduced tldfinder, a tool with three discovery modes: DNS, TLD, and Domain.
- tldfinder queries multiple data sources via APIs to discover domains and associated TLDs, including some sources requiring API keys.
- Demonstrated practical data sources (e.g., crtsh, Netlas) and discussed which sources support domain enumeration vs. only other features.
- Released tldfinder in collaboration with ProjectDiscovery and highlighted how to configure provider keys for better results.
MITRE Techniques
- [T1593] OSINT Collection – Used open-source reconnaissance to gather information about TLDs. “Utilized open-source reconnaissance to gather information about TLDs.”
- [T1483] Domain Generation Algorithms – Explored methods for domain enumeration based on TLDs. “Explored methods for domain enumeration based on TLDs.”
- [T1071] Application Layer Protocol – Used APIs to query for domain information. “Used APIs to query for domain information.”
Indicators of Compromise
- [Domain] Discovery results from DNS/TLD enumeration – google, partners.cloudskillsboost.google, and 46 more
- [TLD] Observed TLDs referenced in examples – .google, .xn--fiq228c5hs
Read more: https://cloud.google.com/blog/topics/threat-intelligence/enumerating-private-tlds/