enenumxela/subdomains.sh

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

subdomains.sh

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

Resources

• The Workflow
• Installation
• Usage
• Credits
• Contribution

The Workflow

Installation

Run the installation script:

curl -s https://raw.githubusercontent.com/hueristiq/subdomains.sh/main/install.sh | bash -

Or run in an ephemeral Docker container:

Clone the repository and run

cd subdomains.sh
# Build the container image
./docker-subdomains.sh build

# After build, you can run the script with the same options listed above.
# Each run will run in a new container, and the container is destroyed after run
./docker-sudomains.sh -d example.com -r 1.1.1.1

# To destroy the container image if desired
./docker-subdomains.sh destroy

Usage

To display this script's help message, use the -h flag:

subdomains.sh -h

           _         _                       _                 _     
 ___ _   _| |__   __| | ___  _ __ ___   __ _(_)_ __  ___   ___| |__  
/ __| | | | '_ \ / _` |/ _ \| '_ ` _ \ / _` | | '_ \/ __| / __| '_ \ 
\__ \ |_| | |_) | (_| | (_) | | | | | | (_| | | | | \__  _\__ \ | | |
|___/\__,_|_.__/ \__,_|\___/|_| |_| |_|\__,_|_|_| |_|___(_)___/_| |_| v1.0.0

USAGE:
  subdomains.sh [OPTIONS]

OPTIONS:
   -d, --domain 			 domain to discover subdomains for *
   -r, --resolvers 			 list of DNS resolvers containing file *
       --skip-passive 			 skip passive discovery discovery
       --use-passive-tools 		 comma(,) separated passive tools to use
       --exclude-passive-tools 		 comma(,) separated passive tools to exclude
       --skip-active 			 skip active discovery discovery
       --skip-dictionary 		 skip discovery from dictionary DNS brute forcing
  -dW, --dictionary-wordlist 		 wordlist for dictionary DNS  brute forcing
       --skip-permutation 		 skip discovery from permutation DNS brute forcing
  -pW, --permutation-wordlist 		 wordlist for permutation DNS brute forcing
       --skip-dns-records 		 skip discovery from DNS records
       --skip-reverse-dns 		 skip discovery from reverse DNS lookup
   -o, --output 			 output text file
       --setup				 install/update this script & dependencies
   -h, --help 				 display this help message and exit

NOTE: options marked with asterik(*) are required.

HAPPY HACKING :)

Credits

Credit goes to the authors of the various tools I used in this script:

• @OWASP for amass
• @hakluke for hakrevdns
• @d3mondev for puredns
• @tomnonom for anew
• @Edu4rdSHL for findomain
• @shenwei356 for rush
• @hueristiq for hqsubfind3r
• @projectdiscovery for subfinder and httpx

Contribution

Issues and Pull Requests are welcome!

subdomains.sh's Issues

Does it only support Ubuntu?

Does it only support Ubuntu?

Dockerfile pulls from EOL Ubuntu 21.10

Recommend changing:

"FROM ubuntu:21.10" to "FROM ubuntu:22.10"

Dockerfile: Permission denied when executing "RUN bash -c ./install.sh"

Recommend adding the following before the line running ./install.sh:

RUN sudo chmod 755 ./install.sh

After building docker image, permission denied running "./docker-subdomains.sh...."

Full error:
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec /home/subdomains/subdomains.sh: permission denied: unknown.

Recommend adding the following before the Entrypoint:

RUN sudo chmod 755 ./subdomains.sh