subdomains.sh

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

Resources

• The Workflow
• Installation
• Usage
• Credits
• Contribution

The Workflow

Installation

Run the installation script:

curl -s https://raw.githubusercontent.com/hueristiq/subdomains.sh/main/install.sh | bash -

Or run in an ephemeral Docker container:

Clone the repository and run

cd subdomains.sh
# Build the container image
./docker-subdomains.sh build

# After build, you can run the script with the same options listed above.
# Each run will run in a new container, and the container is destroyed after run
./docker-sudomains.sh -d example.com -r 1.1.1.1

# To destroy the container image if desired
./docker-subdomains.sh destroy

Usage

To display this script's help message, use the -h flag:

subdomains.sh -h

           _         _                       _                 _     
 ___ _   _| |__   __| | ___  _ __ ___   __ _(_)_ __  ___   ___| |__  
/ __| | | | '_ \ / _` |/ _ \| '_ ` _ \ / _` | | '_ \/ __| / __| '_ \ 
\__ \ |_| | |_) | (_| | (_) | | | | | | (_| | | | | \__  _\__ \ | | |
|___/\__,_|_.__/ \__,_|\___/|_| |_| |_|\__,_|_|_| |_|___(_)___/_| |_| v1.0.0

USAGE:
  subdomains.sh [OPTIONS]

OPTIONS:
   -d, --domain 			 domain to discover subdomains for *
   -r, --resolvers 			 list of DNS resolvers containing file *
       --skip-passive 			 skip passive discovery discovery
       --use-passive-tools 		 comma(,) separated passive tools to use
       --exclude-passive-tools 		 comma(,) separated passive tools to exclude
       --skip-active 			 skip active discovery discovery
       --skip-dictionary 		 skip discovery from dictionary DNS brute forcing
  -dW, --dictionary-wordlist 		 wordlist for dictionary DNS  brute forcing
       --skip-permutation 		 skip discovery from permutation DNS brute forcing
  -pW, --permutation-wordlist 		 wordlist for permutation DNS brute forcing
       --skip-dns-records 		 skip discovery from DNS records
       --skip-reverse-dns 		 skip discovery from reverse DNS lookup
   -o, --output 			 output text file
       --setup				 install/update this script & dependencies
   -h, --help 				 display this help message and exit

NOTE: options marked with asterik(*) are required.

HAPPY HACKING :)

Credits

Credit goes to the authors of the various tools I used in this script:

• @OWASP for amass
• @hakluke for hakrevdns
• @d3mondev for puredns
• @tomnonom for anew
• @Edu4rdSHL for findomain
• @shenwei356 for rush
• @hueristiq for hqsubfind3r
• @projectdiscovery for subfinder and httpx

Contribution

Issues and Pull Requests are welcome!