HTTP_Enum_sh

Automated subdomain enumeration & vulnerability recon tool for bug bounty hunting. It chains together some of the most popular recon tools into a single command so you can go from a domain name to live subdomains, open ports, web technologies, leaked secrets, and vulnerabilities in one run.

Built by saad 0xdy — web pentester & cybersecurity researcher.

---

✨ Features

Enum mode (sc enum)

• 🔍 Subdomain discovery via multiple sources: subfinder, shuffledns, gobuster, assetfinder, gau, and CSP header parsing
• 🧬 Subdomain permutation with alterx
• ✅ Live host validation with dnsx
• 🌐 Port scanning with naabu
• 🧠 Tech/status detection with httpx

Scan mode (sc scan)

• 🛡️ Vulnerability & config scanning with nmap --script=vuln
• 🗃️ Historical URL / archive mining with gau + waybackurls
• 📂 Path & directory fuzzing with dirsearch
• 📄 Sensitive file discovery (xls, sql, json, zip, db, etc.) from archived URLs
• ⚡ Tech detection, CVEs, and vulnerability scanning with nuclei
• 🧾 JS file discovery with katana + gospider
• 🔑 Secret/leak hunting inside JS files with SecretFinder and lazyegg

General

• 🎨 Clean colored CLI output
• ⚙️ Simple flag-based usage with sane defaults

---

📦 Requirements

Make sure the following tools are installed and available in your $PATH. Running ./install.sh (see below) installs all of these for you.

Enum mode

Tool	Purpose
subfinder	Passive subdomain enumeration
shuffledns	Active subdomain bruteforce
gobuster	DNS subdomain bruteforce
assetfinder	Subdomain discovery
gau	Get URLs from archives
unfurl	URL parsing
alterx	Subdomain permutation
dnsx	DNS resolution / live host check
naabu	Port scanning
httpx	HTTP probing & tech detection

Scan mode

Tool	Purpose
nmap	Vulnerability & config scanning (--script=vuln)
dig (dnsutils/bind-utils)	DNS resolution for the nmap scan
gau	Archived URL mining
waybackurls	Archived URL mining
uro	Filtering/deduping archived URLs
dirsearch	Directory/path fuzzing
nuclei	Tech detection, CVE & vuln scanning
katana	Crawling for JS files
gospider	Crawling for JS files
SecretFinder	Secret/leak hunting in JS files
lazyegg	Secret/leak & domain/IP extraction from JS files (custom tool — see note below)
curl, grep, sed, tr, sort, jq	Standard Unix tools

You'll also need:

• A resolvers wordlist (default path: /db/resiolve.txt)
• A subdomain wordlist (default path: /db/wordlist-subs.txt)
• Python 3 + pip (for dirsearch, SecretFinder, uro, jsbeautifier, lxml, requests)

⚠️ lazyegg is referenced by the script (tools_use/lazyegg/lazyegg.py) but isn't a known public repo — drop your own copy into ~/tools_use/lazyegg/ after installing, or remove that call from js_enum() if you don't use it.

---

🚀 Installation

git clone https://github.com/Saad-Ayady/http_enum.git
cd http_enum
chmod +x sc.sh
chmod +x install.sh
./install.sh
sudo ln -s "$(pwd)/sc.sh" /usr/local/bin/sc

install.sh installs Go, all Go-based recon tools (enum + scan mode), system packages (nmap, dig, jq, libpcap-dev), Python libraries (requests, jsbeautifier, lxml, uro), dirsearch, and clones SecretFinder into ~/tools_use/. It also downloads the default resolvers/wordlist into /db/ if they're missing.

Now you can run it from anywhere as sc.

---

🛠️ Usage

sc --version                # print logo and dev info
sc --help                   # print help menu
sc enum -d <domain> [flags] # run subdomain/tech enumeration against a domain
sc scan -u <url> [flags]    # run vulnerability/leak scanning against a target

Enum flags

Flag	Alias	Description	Default
--domain	-d	Target domain (required)	—
--treads	-t	Number of threads	50
--resolve	—	Path to resolvers wordlist	/db/resiolve.txt
--wordlist-dns	—	Path to subdomain wordlist	/db/wordlist-subs.txt
-oF	—	Output folder name	derived from domain (e.g. facebook.com → facebook)

Scan flags

Flag	Alias	Description	Default
--url	-u	Target URL (required, e.g. http://www.facebook.com)	—
--treads	-t	Number of threads	50
-oF	—	Output folder name	derived from the URL's host, stripped of www. and TLD (e.g. http://www.facebook.com → facebook)

Examples

Run enum with all defaults:

sc enum -d facebook.com

Run enum with custom threads, wordlists, and output folder:

sc enum -d facebook.com -t 100 --resolve /db/resiolve.txt --wordlist-dns /db/wordlist-subs.txt -oF facebook

Run scan with all defaults:

sc scan -u http://www.facebook.com

Run scan with custom threads and output folder:

sc scan -u http://www.facebook.com -t 100 -oF facebook

---

📁 Output structure

Each run creates a folder named after -oF (or derived automatically otherwise):

sc enum output

facebook/
├── subs/
│   ├── facebook_subfinder.txt
│   ├── facebook_shuffledns.txt
│   ├── facebook_gobuster.txt
│   ├── facebook_assetfinder
│   ├── facebook_cps.txt
│   ├── facebook_gau.txt
│   ├── facebook_all_subs.txt
│   └── facebook_alterx.txt
└── tec/
    ├── facebook_dnsx.txt
    ├── facebook_naabu.txt
    └── facebook_httpx.txt

sc scan output

facebook/
├── vuln/
│   ├── facebook_nmap_vulns.*        # nmap vuln scan (multiple formats via -oA)
│   ├── facebook_webmachin.txt       # archived URLs (gau + waybackurls)
│   ├── facebook_dirshearch.txt      # dirsearch results
│   ├── facebook_dataFiles.txt       # sensitive files found in archived URLs
│   ├── facebook_nuclei_tec.txt      # tech detection (optional, asked at runtime)
│   ├── facebook_nuclei_vulns.txt    # nuclei vulnerability scan
│   └── facebook_nuclei_cve.txt      # nuclei CVE scan
└── js-scan/
    ├── facebook_js1.txt             # JS files found via katana
    ├── facebook_js2.txt             # JS files found via gospider
    ├── facebook_js_files.txt        # merged/deduped JS file list
    ├── facebook_js_leaks_nuclei.txt
    ├── facebook_js_leaks_SecretFinder.txt
    └── facebook_js_leaks_lazyegg.txt

---

⚠️ Disclaimer

This tool is intended only for authorized security testing — bug bounty programs you're enrolled in, or systems you own or have explicit permission to test. Running recon, scanning, or vulnerability tools against targets without authorization may be illegal. Use responsibly.

---

👤 Author

saad 0xdy Web pentester & cybersecurity researcher

Good luck, get bugs! 🐛