bseb / subdomains.sh

A wrapper around tools I use for subdomain enumeration on a given domain. This script is written with the aim to automate the workflow.

subdomains.sh

subdomains.sh wrapper around tools I use for subdomain enumeration, to automate the workflow, on a given domain.

Resources

• Usage
• Installation
• Credits
• Contribution

Usage

To display this script's help message, use the -h flag:

subdomains.sh -h

           _         _                       _                 _     
 ___ _   _| |__   __| | ___  _ __ ___   __ _(_)_ __  ___   ___| |__  
/ __| | | | '_ \ / _` |/ _ \| '_ ` _ \ / _` | | '_ \/ __| / __| '_ \ 
\__ \ |_| | |_) | (_| | (_) | | | | | | (_| | | | | \__  _\__ \ | | |
|___/\__,_|_.__/ \__,_|\___/|_| |_| |_|\__,_|_|_| |_|___(_)___/_| |_| v1.0.0

USAGE:
  subdomains.sh [OPTIONS]

OPTIONS:
   -d, --domain                          domain to gather subdomains for *
       --use-passive-source              comma(,) separated tools to use
       --exclude-passive-source          comma(,) separated tools to exclude
       --skip-semi-active                skip semi active techniques
   -r, --resolvers                       list of DNS resolvers *
       --skip-dictionary                 skip dictionary brute forcing
  -dW, --dictionary-wordlist             wordlist for dictionary brute forcing
       --skip-permutation                skip permutation brute forcing
  -pW, --permutation-wordlist            wordlist for permutation brute forcing
       --skip-dns-records                skip discovery from DNS records
       --skip-reverse-dns                skip discovery from reverse DNS lookup
       --skip-active                     skip active techniques
   -o, --output                          output text file
       --setup                           install/update this script & dependencies
   -h, --help                            display this help message and exit

NOTE: options marked with asterik(*) are required.

HAPPY HACKING :)

Installation

Run the installation script:

curl -s https://raw.githubusercontent.com/enenumxela/subdomains.sh/main/install.sh | bash -

Or run in an ephemeral Docker container:

Clone the repository and run

cd subdomains.sh
# Build the container image
./docker-subdomains.sh build

# After build, you can run the script with the same options listed above.
# Each run will run in a new container, and the container is destroyed after run
./docker-sudomains.sh -d example.com -r 1.1.1.1

# To destroy the container image if desired
./docker-subdomains.sh destroy

Credits

Credit goes to the authors of the various tools I used in this script:

• @OWASP for amass
• @hakluke for hakrevdns
• @d3mondev for puredns
• @tomnonom for anew
• @Edu4rdSHL for findomain
• @signedsecurity for sigsubfind3r
• @projectdiscovery for subfinder & httpx

Contribution

Issues and Pull Requests are welcome!