Subdomain-Enumaration

These are Subdomain Enumaration Tools that I use, Thanks to all the Authors for making things easy and make sure to comment down which tools you use for Subdomain Enumaration and your methodologies

Using Findomain

Findomain/Findomain

$ findomain -t target.com -o

Using jhaddix All.txt

$ ffuf -w JHADDIX-ALL/all.txt -u "https://FUZZ.target.com/" -v | grep "| URL |" | awk '{print $4}'

Search Subdomain using Gospider

KingOfBugbounty/KingOfBugBountyTips

$ gospider -d 0 -s "https://target.com" -c 5 -t 100 -d 5 --blacklist jpg,jpeg,gif,css,tif,tiff,png,ttf,woff,woff2,ico,pdf,svg,txt | grep -Eo '(http|https)://[^/"]+' | anew

Using Subfinder

projectdiscovery/subfinder

$ subfinder -d target.com -o target.com_subfinder.txt

Search subdomains using jldc

KingOfBugbounty/KingOfBugBountyTips

$ curl -s "https://jldc.me/anubis/subdomains/target.com" | grep -Po "((http|https)://)?(([\w.-]).([\w]).([A-z]))\w+" | anew

Subdomain search Bufferover resolving domain to httpx

KingOfBugbounty/KingOfBugBountyTips

$ curl -s https://dns.bufferover.run/dns?q=.target.com |jq -r .FDNS_A[] | sed -s 's/,/\n/g' | httpx -silent | anew

Using AssetFinder

tomnomnom/assetfinder

$ assetfinder --subs-only target.com >> target.com.txt

Using Knockpy

guelfoweb/knock

$ knockpy.py target.com

Using Amass

OWASP/Amass

$ amass enum -d target.com -o target.com_amass.txt

Using Subbrute

TheRook/subbrute

$ subbrute.py target.com -o target.com_Subbrute.txt

Using Sublist3r

aboul3la/Sublist3r

$ sublist3r.py -d target.com -o target.com_Sublist3r.txt

Using Sudomy

Screetsec/Sudomy

$ sudomy -d target.com

Filter the Valid Subdomains Found

$ while read i; do digout=$(dig +short ${i//[$'\t\r\n ']}); if [[ ! -z $digout ]]; then echo ${i//[$'\t\r\n ']}; fi; done < target.com.txt > target.com_valid.txt

Python Script To Run All Tools In One Go By Me

$ python sub3num.py target.com

#!/usr/bin/python
from subprocess import Popen, PIPE
import sys

domain = sys.argv[1]
commands = ['findomain -t '+domain+' -o;subfinder -d '+domain+' -o '+domain+'_subfinder.txt ;assetfinder --subs-only '+domain+' >> '+domain+'_assetfinder.txt;amass enum -d '+domain+' -o '+domain+'_amass.txt ;python ~/Bug-Tools/subbrute/subbrute.py '+domain+' -o '+domain+'_subbrute.txt ;python ~/Bug-Tools/Sublist3r/sublist3r.py -d '+domain+' -o '+domain+'_sublist3r.txt ;cat *.txt | sort -u >> '+domain+'_final_domains.txt ;cat '+domain+'_final_domains.txt | httprobe | httpx | sort -u >> valid_subs.txt;']
count = 0
processes = []
for com in commands:
    print "Start execute commands.."
    processes.append(Popen(com, shell=True))
    count += 1
    print "[OK] command "+str(count)+" running successfully."
else:
    print "Finish.."

for i, process in enumerate(processes):
    process.wait()
    print "Command #{} finished".format(i)

💬 Contact Me Here:

💬 Comment down which tools you use for Subdomain Enumaration and your methodologies Here 👇

RASSec / Subdomain-Enumaration

Subdomain-Enumaration

About