A subdomain reconnaissance toolkit that combines certificate transparency log lookups, multi-threaded DNS brute-forcing, and live HTTP probing — wrapped in a clean, colorized terminal UI built with Rich.
Built as part of my OSINT/cybersecurity toolset, SubDomain is meant to be a first step in mapping a target's attack surface — the same technique used in real-world penetration testing and bug bounty recon.
Most organizations secure their main website carefully, but forgotten or low-priority subdomains — staging environments, internal admin panels, old API endpoints — are often where real vulnerabilities are found. SubDomain surfaces these by combining two approaches:
- Passive — pulling every subdomain ever logged in public SSL certificates via crt.sh
- Active — brute-forcing common subdomain names and verifying which ones actually resolve and respond
- 🔍 Certificate transparency log lookup — pulls historical subdomain data with zero direct contact to the target
- ⚡ Multi-threaded scanning — configurable thread count for fast brute-force resolution
- 🌐 Live HTTP probing — checks which discovered subdomains are actually up, and their response code
- 🎨 Rich terminal UI — colorized, readable output with progress bars, not a wall of raw text
- 📁 JSON export — every scan saves clean, structured results you can feed into other tools
- 🔄 Built-in update checker — notifies you when a newer release is available on GitHub
- 📖 Built-in wordlist — 200+ common subdomain patterns out of the box, or bring your own
$ python subdomain.py
Choose an option
1. Full scan (CT logs + brute-force + HTTP probe)
2. CT logs only (fast, no brute-force)
3. DNS brute-force only (no CT log lookup)
4. View last saved results
5. About
6. Check for updates
7. Exit
Select an option: 1
Target domain (e.g. example.com): example.com
Threads [30]:
Output filename [results.json]:
[*] Querying certificate transparency logs...
crt.sh → 47 records found
[*] Brute-forcing with wordlist (200+ entries)...
██████████████████████████████████████ 100%
[+] api.example.com 200 OK
[+] staging.example.com 200 OK
[!] old-admin.example.com 403 Forbidden
[+] vpn.example.com 200 OK
51 subdomains found · saved to results.json
git clone https://github.com/himanshurwtt/SubDomain.git
cd SubDomain
pip install -r requirements.txtRequirements: Python 3.8+
Run the tool and follow the interactive menu:
python subdomain.pyYou'll be able to choose between:
| Option | Description |
|---|---|
| 1 | Full scan — CT logs + brute-force + HTTP probe |
| 2 | CT logs only — fast, no brute-forcing |
| 3 | DNS brute-force only — no CT log lookup |
| 4 | View last saved results |
| 5 | About |
| 6 | Check for updates |
| 7 | Exit |
You can supply a custom wordlist path at runtime, or use the built-in list of 200+ common subdomain patterns.
This tool only queries public data sources (certificate transparency logs) and performs standard DNS/HTTP requests — the same kind your browser makes every day. That said, only run reconnaissance against domains you own or have explicit permission to test. Unauthorized scanning of third-party infrastructure may violate terms of service or local law depending on jurisdiction.
- Subdomain takeover detection
- Passive DNS integration (additional sources beyond crt.sh)
- Export to CSV / Markdown report
- Config file support for default scan settings
Built by Himanshu Rawat as part of an ongoing OSINT/cybersecurity toolkit.
- Email: geek3301@proton.me
- Discord: geek7
- Instagram: @himanshuurwt
MIT — see LICENSE for details.