Description:

bash script for Subdomain Enumeration using 4 tools and 3 online services, you have to install these tools by yourself to be able to use SubEnum.sh, or use setup.sh script to install them.

Available Tools and online services:

1. Tools:
   • Findomain
   • SubFinder
   • Amass
   • AssetFinder
   • Httprobe: To Probe For Working HTTP and HTTPS Subdomains.
   • anew: To delete duplicates when using -s/--silent option.
2. online services:
   • WayBackMachine
   • crt.sh
   • AbuseIPDB
   • BufferOver

Installation:

to install the dependencies run:

$ git clone https://github.com/bing0o/SubEnum.git
$ cd SubEnum
$ chmod +x setup.sh
$ ./setup.sh

Usage:

Basic usage:

$ subenum -d target.com 

Resolve The Found Subdomains:

$ subenum -d target.com -r 

Agains a list of domains

$ subenum -l domains.txt -r

Exclude:

$ subenum -d target.com -e Amass,wayback

Use:

$ subenum -d target.com -u Findomain,Subfinder

exclude and use can be used with list of domains too

$ subenum -l domains.txt -u crt,bufferover

Parallel:

the tool parallel must be installed on you system, it runs all the functions at the same time which make the results faster, doesn't work with -u/--use or -e/--exclude options.

$ subenum -d target.com -p

Silent:

this option helps when you want to pipe the results to another tool, or just to avoid the useless output.

$ subenum -d target.com -s 
dev.target.com
admin.target.com
api.target.com
..
..

happy hacking!

Spport:

You can support me here:

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Never Mind 💻

Mehedi Hasan Remon 💻

alins.ir 💻

Akash Sarkar 💻

Cihan Mehmet DOĞAN (CMD) 💻

NoobHunter 💻

Sharo_k_h 💻

This project follows the all-contributors specification. Contributions of any kind welcome!