Subdomain Enum
by @johnnywang2001
Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform r...
clawhub install subdomain-enumπ About This Skill
name: subdomain-enum description: Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform reconnaissance, audit attack surface, find forgotten or exposed services, or map the infrastructure of a domain. No API keys required. Supports custom wordlists, concurrent threads, and JSON output.
Subdomain Enumerator
Discover subdomains for any domain using two complementary techniques: DNS brute-force resolution and certificate transparency log mining via crt.sh.
Quick Start
python3 scripts/subenum.py example.com
Commands
# Basic enumeration (built-in wordlist + crt.sh)
python3 scripts/subenum.py example.comCustom wordlist
python3 scripts/subenum.py example.com --wordlist /path/to/wordlist.txtFaster with more threads
python3 scripts/subenum.py example.com --threads 20DNS only (skip crt.sh)
python3 scripts/subenum.py example.com --no-crtshJSON output
python3 scripts/subenum.py example.com --jsonSave results to file
python3 scripts/subenum.py example.com --output subdomains.txtVerbose progress
python3 scripts/subenum.py example.com -v
Options
| Flag | Default | Description |
|------|---------|-------------|
| --wordlist, -w | built-in (~120 words) | Custom wordlist file |
| --threads, -t | 10 | Concurrent DNS resolution threads |
| --timeout | 15 | HTTP timeout for crt.sh query |
| --no-crtsh | off | Skip certificate transparency lookup |
| --json | off | Output as JSON |
| --output, -o | β | Write results to file |
| --verbose, -v | off | Show progress during scan |
Techniques
1. DNS Brute-force β Resolves {word}.{domain} against DNS for each word in the wordlist. Returns IP addresses for live subdomains.
2. Certificate Transparency (crt.sh) β Queries public CT logs for certificates issued to *.domain, revealing subdomains that may not respond to DNS but have had TLS certificates.
Dependencies
pip install requests
Notes
π‘ Examples
python3 scripts/subenum.py example.com
βοΈ Configuration
| Flag | Default | Description |
|------|---------|-------------|
| --wordlist, -w | built-in (~120 words) | Custom wordlist file |
| --threads, -t | 10 | Concurrent DNS resolution threads |
| --timeout | 15 | HTTP timeout for crt.sh query |
| --no-crtsh | off | Skip certificate transparency lookup |
| --json | off | Output as JSON |
| --output, -o | β | Write results to file |
| --verbose, -v | off | Show progress during scan |