Async Subdomain Enumerator & DNS Bruteforcer — Fast, multi-threaded subdomain discovery with passive and active enumeration.
Also in redx. This tool has been ported into redx — a local security toolkit with a web UI — as its Subdomain Enumerator module.
- 🚀 Multi-threaded DNS bruteforce — 50+ concurrent threads for fast enumeration
- 🔎 Passive enumeration — Certificate Transparency logs via crt.sh
- 📋 Built-in wordlist — 150+ common subdomain prefixes included
- 📝 Custom wordlists — Bring your own wordlist for targeted bruteforcing
- 🎯 CNAME detection — Identify potential subdomain takeover targets
- 📊 Multiple output formats — JSON, TXT, or colored terminal output
- ⚡ Zero dependencies — Pure Python, no external packages required
```bash git clone https://github.com/redX000/SubHunter.git cd SubHunter pip install -e . ```
```bash
subhunter example.com
subhunter example.com -p
subhunter example.com -w /path/to/wordlist.txt -t 100
subhunter example.com --json
subhunter example.com -o results.json subhunter example.com -o subdomains.txt ```
``` 🔍 SubHunter — Async Subdomain Enumerator
Target: example.com Threads: 50
[*] Bruteforcing 150 subdomains... [120/150] 80% — 245/s — 12 found
══════════════════════════════════════════ 🎯 Results: 12 subdomains found ⏱ Time: 2.3s ══════════════════════════════════════════
Subdomain IP Address Source ──────────────────────────────────────── ────────────────── ──────────── api.example.com 93.184.216.34 bruteforce blog.example.com 93.184.216.34 bruteforce mail.example.com 93.184.216.40 passive www.example.com 93.184.216.34 bruteforce ```
| Method | Description |
|---|---|
| DNS Bruteforce | Multi-threaded A record resolution |
| crt.sh | Certificate Transparency log mining |
| CNAME Detection | Identify dangling CNAMEs for takeover |
This tool is for authorized security testing and educational purposes only. Always obtain proper authorization before scanning any domain. The author is not responsible for any misuse.
MIT License — see LICENSE
Yassine Lasraoui — @redX000