This linux script is intended to simplify the process of subdomain enumeration. Think of it as a "press this button and have it do all the things for subdomain web enumeration". In particular, it's looking to:
- Enumerate and consolidate subdomains from multiple sources using multiple tools.
- Conduct scans for web servers hosted on common ports.
- Take screenshots and output a report.
git clone https://github.com/gelosecurity/subdomagicinto your/optdirectory (MUST BE IN OPT!)- Navigate into the setup directory
- Run the
setup.shscript
Due to long enumeration time, it is highly suggested to use this on a VPS or remote host, and use the screen command to keep the session running in the background.
./subdomagic.sh[1] fast is intended for host quick subdomain/host discovery and also includes a TCP and version scan of common ports for nmap's OS detection. Useful if you just want to see externally available webservers in a reasonable amount of time.
[2] comprehensive is intended for extremely thorough subdomain enumeration and will scan the top 1000 TCP ports on each active host. Useful if you want a more comprehensive scan on what ports are available externally. This is intended as a "catch all method" as it uses Jason Haddix's all.txt for bruting subdomains.
In the directory output, you will have a directory based on the domain name example.com.
In the directory output/example.com, the files included are
domain-nmap-fast.gnmapor/anddomain-nmap-comprehensive.gnmapscan depending on whether or not you did a quick or verbose scandomain.eyewitnessfolder and thereport.htmlthat is in itdomain-subdomains.txtfor any subdomains you're interested indomain-webservers.txtfor the IPs of active webservers within the subdomain list
DM me on Twitter: https://twitter.com/gelosecurity