ENUM-SUB TOOL

A simple Python-based subdomain enumeration tool using DNS resolution and wordlist brute force techniques.

This tool is intended for educational purposes and authorized security testing only.

Features

• DNS resolution (A records)
• Subdomain brute force using wordlists
• Multithreaded subdomain brute force
• Real-time CLI status display
• Clean and stable terminal output
• Lightweight and easy to extend
• Modular Python structure

---

Project Structure

enum-sub/
├── enum_sub/
│   ├── __init__.py
│   ├── main.py
│   └── dns_enum.py
├── wordlists/
│   └── subs.txt
├── requirements.txt
└── README.md

---

Requirements

• Python 3.8+
• Linux (tested on Pop!_OS)
• dnspython

Install dependencies:

pip install -r requirements.txt

---

Installation

git clone https://github.com/staiton/enum-sub.git
cd enum-sub
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Usage

Basic usage:

python3 -m enum_sub.main example.com -w wordlists/subs.txt

Use with more threads:

python3 -m enum_sub.main example.com -w wordlists/subs.txt -t 50

Saving the results to a file:

python3 -m enum_sub.main example.com -w wordlists/subs.txt -o results.txt

---

Example Output

╔════════════════════════════════════════════╗
║               ENUM-SUB TOOL                ║
║        Subdomain Brute Force Scanner       ║
╠════════════════════════════════════════════╣
║  Author : staiton                          ║
║  Mode   : Multithreaded DNS Enumeration    ║
║  Status : Ready                            ║
╠════════════════════════════════════════════╣
║  Use only on authorized targets            ║
╚════════════════════════════════════════════╝

[*] Checking for wildcard DNS...
[+] Target   : example.com
[+] Wordlist : 5000 entries
[+] Threads  : 20
--------------------------------------------------

[FOUND] www.example.com -> 93.184.216.34
[FOUND] mail.example.com -> 93.184.216.35

--------------------------------------------------
[+] Scan complete. 2 subdomain(s) found.

 SUBDOMAIN                                    IP
 ──────────────────────────────────────────── ───────────────
 mail.example.com                              93.184.216.35
 www.example.com                               93.184.216.34

---

How it works

1. Loads a wordlist of common subdomain names
2. Appends each word to the target domain
3. Performs DNS A record lookup
4. Uses multithreading for fast DNS resolution
5. Displays live scanning status in terminal
6. Ensures clean output during concurrent execution

---

Legal Disclaimer

This tool is for:

Educational purposes Authorized penetration testing Security research in controlled environments

Do NOT use against domains you do not own or have permission to test.

The author is not responsible for misuse.

Author

• @staiton