泛解析子域名爆破方法

CNAME方式查询子域名时，有些泛解析域名会返回不一样的值，通过这样的差异可以排除泛解析的干扰，发现有价值的资产。老古董办法了，还是sn00py表哥教的

Resolve-DnsName -Type CNAME aaa.tmall.com

Name                           Type   TTL   Section    NameHost
----                           ----   ---   -------    --------
aaa.tmall.com                  CNAME  591   Answer     shop.tmall.com

Resolve-DnsName -Type CNAME crm.tmall.com

Name                           Type   TTL   Section    NameHost
----                           ----   ---   -------    --------
crm.tmall.com                  CNAME  1     Answer     na61-na62.wagbridge.alibaba.tmall.com

PowerShell写了一个勉强能用的

Get-Content ~\Desktop\dic.txt | foreach {
    $domain = $_ + ".tmall.com";
    $result = Resolve-DnsName -Type CNAME $domain -Server 223.5.5.5 -ErrorAction "SilentlyContinue";
    if (!$?) {}
    else {
        $resolveDomain = $result.NameHost;
        if ($resolveDomain -ne "shop.tmall.com" -And $resolveDomain -notlike "*tmall.com.danuoyi.tbcache.com") {
            $out = "{0,-20}| {1,10}" -f $domain, $resolveDomain
            Write-Output $out
        }
    }
}