Subdomain Enumerator
Discover subdomains for any domain using two complementary techniques: DNS brute-force resolution and certificate transparency log mining via crt.sh.
Quick Start
CODEBLOCK0
Commands
CODEBLOCK1
Options
| Flag | Default | Description |
|---|
| INLINECODE0 | built-in (~120 words) | Custom wordlist file |
| INLINECODE1 |
10 | Concurrent DNS resolution threads |
|
--timeout |
15 | HTTP timeout for crt.sh query |
|
--no-crtsh | off | Skip certificate transparency lookup |
|
--json | off | Output as JSON |
|
--output, -o | — | Write results to file |
|
--verbose, -v | off | Show progress during scan |
Techniques
- 1. DNS Brute-force — Resolves
{word}.{domain} against DNS for each word in the wordlist. Returns IP addresses for live subdomains. - Certificate Transparency (crt.sh) — Queries public CT logs for certificates issued to
*.domain, revealing subdomains that may not respond to DNS but have had TLS certificates.
Dependencies
CODEBLOCK2
Notes
- - Built-in wordlist covers common subdomains (www, api, mail, staging, etc.)
- For comprehensive scans, use a larger wordlist (e.g., SecLists DNS wordlists)
- Results are deduplicated across sources
- Use responsibly — only scan domains you own or have authorization to test
子域名枚举器
通过两种互补技术发现任意域名的子域名：DNS暴力破解解析和通过crt.sh进行的证书透明度日志挖掘。
快速开始
bash
python3 scripts/subenum.py example.com
命令
bash
基础枚举（内置词表 + crt.sh）
python3 scripts/subenum.py example.com
自定义词表
python3 scripts/subenum.py example.com --wordlist /path/to/wordlist.txt
使用更多线程加速
python3 scripts/subenum.py example.com --threads 20
仅DNS（跳过crt.sh）
python3 scripts/subenum.py example.com --no-crtsh
JSON输出
python3 scripts/subenum.py example.com --json
保存结果到文件
python3 scripts/subenum.py example.com --output subdomains.txt
详细进度显示
python3 scripts/subenum.py example.com -v
选项
| 标志 | 默认值 | 描述 |
|---|
| --wordlist, -w | 内置（约120个词） | 自定义词表文件 |
| --threads, -t |
10 | 并发DNS解析线程数 |
| --timeout | 15 | crt.sh查询的HTTP超时时间 |
| --no-crtsh | 关闭 | 跳过证书透明度查询 |
| --json | 关闭 | 以JSON格式输出 |
| --output, -o | — | 将结果写入文件 |
| --verbose, -v | 关闭 | 扫描期间显示进度 |
技术原理
- 1. DNS暴力破解 — 对词表中的每个词，向DNS解析{word}.{domain}。返回活跃子域名的IP地址。
- 证书透明度（crt.sh） — 查询公开的CT日志，获取颁发给*.domain的证书，从而发现可能不响应DNS但拥有TLS证书的子域名。
依赖项
bash
pip install requests
注意事项
- - 内置词表涵盖常见子域名（www、api、mail、staging等）
- 如需全面扫描，请使用更大的词表（例如SecLists DNS词表）
- 结果会跨来源去重
- 请负责任地使用——仅扫描您拥有或获得授权测试的域名
