How to get unresolved subdomains after active scan

[raladev]

Good day,

Is there a way to get unresolved subdomains, when you enumerate subdomains in active mode?

After scanning i get only subdomains that were successfully resolved to ips (subdomains.txt).
But i also need unresolved list of subdomains or just list of whole subdomains to subtract resolved list.
They are pretty good fit for permutation OR virtual host enumeration.

BTW i also use neo4j output mode, so, maybe there is a way to select only unresolved dns_names after scan

[TheTechromancer]

Yes, these get emitted as DNS_NAME_UNRESOLVED events, but are excluded from output by default (they are still distributed to modules and used for subdomain permutations).

To see them, you can remove the type from omit_event_types on the cli:

bbot -c omit_event_types=[HTTP_RESPONSE]

...or in your preset:

config:
  omit_event_types:
    - HTTP_RESPONSE
    # - DNS_NAME_UNRESOLVED

[raladev]

Thank you, works like a charm!