gopinath6 / sub.sh

Online Subdomain Detect Script

🎯🕸📘 Online Subdomain Detect Script

✨ 🔺Sub.sh but without API key 🔻

https://github.com/cihanmehmet/sub.sh

‼️ jq and httprobe required 📌

Linux Install (Debian,Kali Linux,Ubuntu)

sudo apt-get install jq

MAC OSX Install

brew install jq

📘 ✅Used Services

https://crt.sh

http://web.archive.org

https://dns.bufferover.run

https://www.threatcrowd.org

https://api.hackertarget.com

https://certspotter.com

https://suip.biz

USAGE 💡

Script Usage 🎯

bash sub.sh webscantest.com

./sub.sh webscantest.com

Curl Usage 🎯

curl -sL https://raw.githubusercontent.com/cihanmehmet/sub.sh/master/sub.sh | bash -s webscantest.com

🔖 Curl shortened link usage

curl -sL https://git.io/JesKK | bash -s tesla.com

---

🧱🔨 Multiprocessing(Parallel) Subdomain Detect

‼️ jq , httprobe and parallel required 📌

Debian Install apt install parallel

Mac OSX Install brew install parallel

bash parallel_sub.sh bing.com

curl -sL https://git.io/Jebz5|bash -s bing.com

---

Subdomain Alive Check 🎯

bash sub_alive.sh bing.com

curl -sL https://raw.githubusercontent.com/cihanmehmet/sub.sh/master/sub_alive.sh | bash -s bing.com

‼️ fping required

---

🔓 Nmap -sn (No port scan) scan live IP detection script

fping -f ip.txt

Usage bash nmap_sn.sh ip.txt

#!/bin/bash

nmap -sn -iL $1 |grep "Nmap scan report for"|grep -Eo "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|sort -u |tee $1.txt

echo "Detect IP $(wc -l $1.txt|awk '{ print $1 }' )" "=> result_${1}" "saved"
echo "File Location : "$(pwd)/"result_$1"

---

🔑 Other Resources for subdomain Detection

📜 DNSGEN Generates combination of domain names from the provided input. :cyclone: dnsgen

DNSGEN install

pip install dnsgen

---

🔖 Sample usage

Usage 1(fping)fping 🎯

cat domains.txt | dnsgen - |fping|grep "alive"|cut -d " " -f1>resolvers.txt

Usage 2(httprobe ) 🎯

Kali Linux httprobe Install 🔑

wget https://github.com/tomnomnom/httprobe/releases/download/v0.1.2/httprobe-linux-amd64-0.1.2.tgz

bash tar -xvzf httprobe-linux-amd64-0.1.2.tgz

cp httprobe /usr/local/bin

chmod +x /usr/local/bin/httprobe

---

Tool Usage

cat domains.txt | dnsgen - |httprobe|cut -d "/" -f3|sort -u |tee resolvers.txt

dnsgen domain.txt -w subdomains-10000.txt|httprobe|cut -d "/" -f3|sort -u |tee dnsgen.txt

pip3 install ludicrousdns 

cat domain.txt|ludicrousdns resolve |cut -d " " -f1

---

🔑 📜 Subdomain Detect Terminal Shortcut Function

nano ~/.zshrc

or

nano ~/.bashrc

function subdomain() { curl -sL https://git.io/JesKK | bash -s $1 }

💡 Usage

subdomain webscantest.com

---

🧵 Docker Usage

cihanmehmet#4

---

🚩 💻 I am open to suggestions for improvement.

---

---

CMD

---

🚩 💻 I am open to suggestions for improvement.