# AzSubEnum | Azure Service Subdomain Enumeration

**URL:** <https://onehack.st/t/azsubenum-azure-service-subdomain-enumeration/276522>\
**Category:** Tools & Scripts\
**Tags:** hacking, cloud-storage, hosting\
**Created:** [February 27, 2024, 10:53pm UTC](https://onehack.st/t/azsubenum-azure-service-subdomain-enumeration/276522 "2024-02-27T22:53:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [February 27, 2024, 10:53pm UTC](https://onehack.st/t/azsubenum-azure-service-subdomain-enumeration/276522/1 "2024-02-27T22:53:05Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/1/611df549ddf1ec7fe0a3f831f24a42bd15dbde9d.jpeg)

# AzSubEnum - Azure Service Subdomain Enumeration

AzSubEnum is a specialized subdomain enumeration tool tailored for Azure services. This tool is designed to meticulously search and identify subdomains associated with various Azure services. Through a combination of techniques and queries, AzSubEnum delves into the Azure domain structure, systematically probing and collecting subdomains related to a diverse range of Azure services.

## How it works?

AzSubEnum operates by leveraging DNS resolution techniques and systematic permutation methods to unveil subdomains associated with Azure services such as Azure App Services, Storage Accounts, Azure Databases (including MSSQL, Cosmos DB, and Redis), Key Vaults, CDN, Email, SharePoint, Azure Container Registry, and more. Its functionality extends to comprehensively scanning different Azure service domains to identify associated subdomains.

With this tool, users can conduct thorough subdomain enumeration within Azure environments, aiding security professionals, researchers, and administrators in gaining insights into the expansive landscape of Azure services and their corresponding subdomains.

## Why i create this?

During my learning journey on Azure AD exploitation, I discovered that the Azure subdomain tool, [Invoke-EnumerateAzureSubDomains](https://github.com/NetSPI/MicroBurst/blob/master/Misc/Invoke-EnumerateAzureSubDomains.ps1) from NetSPI, was unable to run on my Debian PowerShell. Consequently, I created a crude implementation of that tool in Python.

## Usage

```auto
➜ AzSubEnum git:(main) ✗ python3 azsubenum.py --help
usage: azsubenum.py [-h] -b BASE [-v] [-t THREADS] [-p PERMUTATIONS]

Azure Subdomain Enumeration

options:
  -h, --help show this help message and exit
  -b BASE, --base BASE Base name to use
  -v, --verbose Show verbose output
  -t THREADS, --threads THREADS
                        Number of threads for concurrent execution
  -p PERMUTATIONS, --permutations PERMUTATIONS
                        File containing permutations

```

Basic enumeration:

```auto
python3 azsubenum.py -b retailcorp --thread 10

```

Using permutation wordlists:

```auto
python3 azsubenum.py -b retailcorp --thread 10 --permutation permutations.txt

```

With verbose output:

```auto
python3 azsubenum.py -b retailcorp --thread 10 --permutation permutations.txt --verbose

```

## Screenshot

[![AzSubEnum](https://camo.githubusercontent.com/d7a21a90b14bab4997fc0d9335e0dd62a7c4fb67119674893c195c5935049dc9/68747470733a2f2f626c6f676765722e676f6f676c6575736572636f6e74656e742e636f6d2f696d672f622f523239765a32786c2f4156765873456a4a667230466f542d326d7130427379767432716237744470356c4f554138646d6346775f3247417246474f674379774f5a456d6b59596470656e42516e494f585f723158367855644a64464d4846787744437231386e5474624977625f674b7050656e4c6a3231344169694c434e465f644561304d556531504c554a38734f636e666357596e7953447a4a4338587a4265694843676333665867596f7453506d41526d6e7a6c6e5146417858464d642d736a6f4f6b76456265512d58312f73393030)](https://camo.githubusercontent.com/d7a21a90b14bab4997fc0d9335e0dd62a7c4fb67119674893c195c5935049dc9/68747470733a2f2f626c6f676765722e676f6f676c6575736572636f6e74656e742e636f6d2f696d672f622f523239765a32786c2f4156765873456a4a667230466f542d326d7130427379767432716237744470356c4f554138646d6346775f3247417246474f674379774f5a456d6b59596470656e42516e494f585f723158367855644a64464d4846787744437231386e5474624977625f674b7050656e4c6a3231344169694c434e465f644561304d556531504c554a38734f636e666357596e7953447a4a4338587a4265694843676333665867596f7453506d41526d6e7a6c6e5146417858464d642d736a6f4f6b76456265512d58312f73393030)

## Let’s contribute!

Do you have any ideas on how to enhance this tool? Let’s contribute!

## Disclaimer

Any actions and or activities related to the material contained within this tool is solely your responsibility. The misuse of the information in this tool can result in criminal charges brought against the persons in question.

## GitHub:

> **[GitHub - yuyudhn/AzSubEnum: Azure Service Subdomain Enumeration](https://github.com/yuyudhn/AzSubEnum)**
>
> Azure Service Subdomain Enumeration