subdomain-bruteforcer (SubBrute)

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting (https://www.us-cert.gov/ncas/alerts/TA13-088A). This design also provides a layer of anonymity, as SubBrute does not send traffic directly to the target’s name servers.

 Installation

sudo apt-get install python-dnspython

git clone https://github.com/TheRook/subbrute.git

names.txt contains 101,010 subdomains. subs_small.txt was stolen from fierce2 which contains 1896 subdomains. If you find more subdomains to add, open a bug report or pull request and I’ll be happy to add them.

No install required for Windows, just cd into the ‘windows’ folder:

• subbrute.exe google.com

Easy to install: You just need http://www.dnspython.org/ and python2.7 or python3. This tool should work under any operating system: bsd, osx, windows, linux…

Usage

Easy to use:



./subbrute.py google.com

Tests multiple domains:



./subbrute.py google.com gmail.com blogger.com

or a newline delimited list of domains:



./subbrute.py -t list.txt

Also keep in mind that subdomains can have subdomains (example: _xmpp-server._tcp.gmail.com):



./subbrute.py gmail.com > gmail.out



./subbrute.py -t gmail.out

 Source: Github