🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
πŸ¦€ ClawHub

Subdomain Enum

by @johnnywang2001

Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform r...

Versionv1.0.0
Downloads797
TERMINAL
clawhub install subdomain-enum

πŸ“– About This Skill


name: subdomain-enum description: Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform reconnaissance, audit attack surface, find forgotten or exposed services, or map the infrastructure of a domain. No API keys required. Supports custom wordlists, concurrent threads, and JSON output.

Subdomain Enumerator

Discover subdomains for any domain using two complementary techniques: DNS brute-force resolution and certificate transparency log mining via crt.sh.

Quick Start

python3 scripts/subenum.py example.com

Commands

# Basic enumeration (built-in wordlist + crt.sh)
python3 scripts/subenum.py example.com

Custom wordlist

python3 scripts/subenum.py example.com --wordlist /path/to/wordlist.txt

Faster with more threads

python3 scripts/subenum.py example.com --threads 20

DNS only (skip crt.sh)

python3 scripts/subenum.py example.com --no-crtsh

JSON output

python3 scripts/subenum.py example.com --json

Save results to file

python3 scripts/subenum.py example.com --output subdomains.txt

Verbose progress

python3 scripts/subenum.py example.com -v

Options

| Flag | Default | Description | |------|---------|-------------| | --wordlist, -w | built-in (~120 words) | Custom wordlist file | | --threads, -t | 10 | Concurrent DNS resolution threads | | --timeout | 15 | HTTP timeout for crt.sh query | | --no-crtsh | off | Skip certificate transparency lookup | | --json | off | Output as JSON | | --output, -o | β€” | Write results to file | | --verbose, -v | off | Show progress during scan |

Techniques

1. DNS Brute-force β€” Resolves {word}.{domain} against DNS for each word in the wordlist. Returns IP addresses for live subdomains. 2. Certificate Transparency (crt.sh) β€” Queries public CT logs for certificates issued to *.domain, revealing subdomains that may not respond to DNS but have had TLS certificates.

Dependencies

pip install requests

Notes

  • Built-in wordlist covers common subdomains (www, api, mail, staging, etc.)
  • For comprehensive scans, use a larger wordlist (e.g., SecLists DNS wordlists)
  • Results are deduplicated across sources
  • Use responsibly β€” only scan domains you own or have authorization to test
  • πŸ’‘ Examples

    python3 scripts/subenum.py example.com
    

    βš™οΈ Configuration

    | Flag | Default | Description | |------|---------|-------------| | --wordlist, -w | built-in (~120 words) | Custom wordlist file | | --threads, -t | 10 | Concurrent DNS resolution threads | | --timeout | 15 | HTTP timeout for crt.sh query | | --no-crtsh | off | Skip certificate transparency lookup | | --json | off | Output as JSON | | --output, -o | β€” | Write results to file | | --verbose, -v | off | Show progress during scan |

    πŸ“‹ Tips & Best Practices

  • Built-in wordlist covers common subdomains (www, api, mail, staging, etc.)
  • For comprehensive scans, use a larger wordlist (e.g., SecLists DNS wordlists)
  • Results are deduplicated across sources
  • Use responsibly β€” only scan domains you own or have authorization to test