Bash wrapper for multiple subdomain enumeration scripts
- Amass
- Turbolist3r
- Assetfinder
- OneForAll
- HTTProbe
- Chaos // you'll need an API key
- HTTPResponseChecker
- HTTPX
The script will run all scripts independently, and merge & clean all results in one file. It also supports enumeration of secondlevel subdomains such as subdomain.target.example.com.
git clone https://github.com/bluecanarybe/SubdomainEnum.git
Build the image with Docker
docker build -t subdomainenum .
Run Docker container replacing with your chaos API key as an environment variable and target
docker run -e CHAOS_KEY="$API_KEY_HERE" -v $(pwd):/tmp subdomainenum ./subdomains.sh target.com