The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto will brute force subdomains using parallel sub processing on the top 20000 of the ‘The Alexa Top 1 Million subdomains’. NetCraft results are presented individually and are then compared to the brute force results, any duplications are removed and particularly interesting results are highlighted.
Latest version v-1.1.5:
+ Cleaning of source, formating and output
pip install git+git://github.com/RandomStorm/Bluto
pip install git+git://github.com/RandomStorm/Bluto –upgrade