Skip to content
Multi Tool Subdomain Enumeration
Branch: master
Clone or download
Latest commit 4509a08 Mar 2, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
ext Change the script to allow being ran from anywhere. Aug 29, 2017
.gitignore Update readme Nov 3, 2017
LICENSE Create LICENSE Feb 26, 2018 Updated EyeWitness references Oct 22, 2018 Fix for #9 - massdns cmd Mar 2, 2019


A domain name enumeration tool

Gist: Some terrible continually updated python code leveraging some awesome tools that I use for bug bounty reconnaissance.

The tools contained in domained requires Kali Linux (preferred) or Debian 7+ and Recon-ng

domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output)

Initial Install:
  • domained tools: python --install
  • Python required modules: sudo pip install -r ./ext/requirements.txt
Other Dependencies:
  • ldns library for DNS programming:
    • sudo apt-get install libldns-dev -y
  • Go Programming Language:
    • sudo apt-get install golang

NOTE: This is an active recon – only perform on applications that you have permission to test against.

Tools leveraged:
Subdomain Enumeraton Tools:
  1. Sublist3r by Ahmed Aboul-Ela
  2. enumall by Jason Haddix
  3. Knock by Gianni Amato
  4. Subbrute by TheRook
  5. massdns by B. Blechschmidt
  6. Recon-ng by Tim Tomes (LaNMaSteR53)
  7. Amass by Jeff Foley (caffix)
  8. SubFinder by by Ice3man543
Reporting + Wordlists:
First Step:
Install Required Python Modules: sudo pip install -r ./ext/requirements.txt
Install Tools: sudo python --install

Example 1: python -d
Uses subdomain (Sublist3r (+subbrute), enumall, Knock, Amass, and SubFinder)

Example 2: python -d -b -p --vpn
Uses subdomain with seclist subdomain list bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall, and SubFinder), adds ports 8443/8080 and checks if on VPN

Example 3: python -d -b --bruteall
Uses subdomain with large-all.txt bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall and SubFinder)

Example 4: python -d --quick
Uses subdomain and only Amass and SubFinder

Example 5: python -d --quick --notify
Uses subdomain, only Amass and SubFinder and notification

Example 6: python -d --noeyewitness
Uses subdomain with no EyeWitness

Note: --bruteall must be used with the -b flag
Option Description
--install/--upgrade Both do the same function – install all prerequisite tools
--vpn Check if you are on VPN (update with your provider)
--quick Use ONLY Amass and SubFinder
--bruteall Bruteforce with JHaddix All.txt List instead of SecList
--fresh Delete old data from output folder
--notify Send Pushover or Gmail Notifications
--active EyeWitness Active Scan
--noeyewitness No Eyewitness
-d The domain you want to preform recon on
-b Bruteforce with subbrute/massdns and SecList wordlist
-s n Only HTTPs domains
-p Add port 8080 for HTTP and 8443 for HTTPS
  • Complete the ext/notifycfg.ini for Pushover or Gmail notifications. (Enable must be set to True)
  • Please see the Pushover API info here and instructions on how to allow less secure apps on your gmail account here
To-Do List
  • Multiple Domains
  • Notifications
  • Subdomains from censys
  • Subdomains from Shodan
  • Web Frontend/Dashboard
  • Add SubFinder
Thank You to Contributors
Major Updates
  • 07-15-2017: Updated to include error handling and updated reconnaissance techniques from Bugcrowd's LevelUp Conference (including subbrute/masscan and subdomain lists) - influenced by Jason Haddix's talk Bug Hunter's Methodology 2.0
  • 08-09-2017: Various fixes (+ phantomjs error), added --fresh option, removed redundant PyBrute folder from output and added pip requirements.txt
  • 08-15-2017: Added notification (--notify) option with Pushover or Gmail support
  • 08-18-2017: Moved repo from OrOneEqualsOne/reconned
  • 09-28-2017: Updated for Recon-ng dependency + Python3 changes
  • 06-20-2018: Added Amass and option for no EyeWitness
  • 10-12-2018: Added SubFinder
You can’t perform that action at this time.