celleight/subsurface

A domain recon tool capable of finding subdomains and subnets and then harvesting HTTP screen shots and whois data about them.

subsurface

A domain recon tool capable of finding subdomains and subnets and then harvesting HTTP screen shots and whois data about them.

Usage

Subsurfce has two modes, in the default mode it just enumerates subdomains. To use this just type:

$ ./subsurface.sh fbi.gov

This will output results into a new ./fbi.gov in the current directory.

In the other mode subsurface also enumerates all the subnets that the identified subdomains are a part of and scans these for active hosts which then are also used to harvest screen grabs of any running http servers. To do this just add the -subnet flag:

$ ./subsurface.sh cia.gov -subnet

Installation

Before you can run subsurface you will need to make sure that you have the following programs installed and available via your PATH environmental variable.

• subfinder
• amass
• assetfinder
• sublist3r
• gowitness
• fping
• whois

Problems and Contributions

If you have noticed any bugs or wish to contribute to the project by all means go ahead and open and issue or pull request respectively and I'll be sure to take a look! Any help with this is project is quite welcome.

subsurface's Issues

Maybe update your readme to highlight that the prerequisites need linux

Hello,

First of all, Thank you for such a wonderful tool. I haven't tried it yet, but I will be doing so shortly.

Looking over the requirements I realized, only after I recognized a couple of the tools that I need to run this on a Linux terminal.

Maybe it's just me (in which case feel free to delete this issue), but I feel it might be helpful to let folks know they will need a Linux terminal. Of course this can be via WSL on Windows so it won't leave any platform out; just make it obvious for those not familiar.

I hope this helps.

Possible tool name change found

Hello,

I was testing out the tool yesterday and kept getting an error message about "httprobe-bin". I couldn't find a package with that name anywhere so I edited your script and changed it to "httprobe" and it finally worked.

Please look into and it and maybe update script or let me know if I am missing something.

What I changed:
From
cat $subdomains_file | httprobe-bin -p http:8080,https:8443 > $live_subdomains_file
To
cat $subdomains_file | httprobe -p http:8080,https:8443 > $live_subdomains_file

I hope that helps.

Regards,
Mikey