Subhawk is a python worlist-based tool that is used for discovering subdomains associated with a target domain in a fast efficient manner by utilising asynchronous programming techniques. SubHawk enumerates subdomains by reading through a wordlist file line by line, combining each entry with the target domain and it then sends asynchronous HTTP requests to each subdomain. This assists bug bounty hunters and penetration tester
- Asynchronous (fast results and customisable)
- Capable of using large wordlist files
- Option for outputting the results in a .txt file
- Clone the repository:
git clone https://github.com/anandvelango/SubHawk.git
- Change directory:
cd SubHawk
- Install all the required modules
pip3 install -r requirements.txt
SubHawk supports at least Python 3.6.x so make sure you have at least Python 3.6.x installed on your system.
- asyncio
- httpx
- time
- argparse
- colorama
You can use our current sample wordlist file wordlists/subdomains.txt from our repository but you can also use wordlists from your Kali machine or download some from internet. Use whichever you need.
| Short form | Long form | Description |
|---|---|---|
| -d | --domain | Domain in which you want to enumerate subdomains |
| -w | --wordlist-file | Path to wordlist file |
| -o | --output | Output the results in a .txt file |
| -s | --semaphores | Adjust the semaphores (speed) if required (by default it's set to 100 but change it accordingly) |
| -h | --help | Show this help message and exit |
- To get help about the tool:
python3 subhawk.py -h
- To find subdomains (always requires a wordlist file)
python3 subhawk.py -d example.com -w <path to wordlist file>
- Save the results in a file
python3 subhawk.py -d example.com -w <path to file> -o <file>.txt
- Adjust the semaphores (speed)
python3 subhawk.py -d example.com -w <path to file> -s <semaphores: int>
- find URLs for cloud storage services like S3
- add more smaller and larger subdomain wordlists