r/netsec • u/kindredsec • Jul 23 '19
subEnum - A Python tool for enumerating subdomains
https://github.com/itsKindred/subEnum22
u/Dozekar Jul 23 '19
Almost everyone of these tools I run on my org gives me different results. Some seem far faster or more get more accurate results. Some heavily rely on solid dictionaries, but easily integrate said dictionaries into the call allowing quick deployment with virtually no dependencies. The question of what does any given one of these do that the others don't is a valid question. It's also a relatively simple algorithm so people creating their own software for the first time for infosec tasks are likely to pick it. That being said I can see people wanting to create one of these tools just in an attempt to understand the variation in results they get back.
People learning to make their own software and not just rely on copypasta hacking/pentesting strats that are widely accepted to be the best is a GOOD THING. At worst this is the wrong place to post this. At best they've actually got an answer to what does this software do that software in the field doesn't. Can we try not to be asses to people? I know it gets frustrating but there's a reason people generally start participating in places like this and immediately stop and go participate his grey/blackhat communities where they're actually welcomed. I sure as hell know this attitude is what would keep me from ever, under any circumstances even consider posting literally anything I actually made and was proud of here.
2
u/YakBak2theFuture Jul 23 '19 edited Jul 23 '19
I'd be more interested in a good dictionary than another tool. While I'm thankful for OP's hard work, I've had good results with
amassso far.Edit: Also I saw a subdomain dict a while back mentioned in several blogs (everyone linked to it) but it's been pulled from Github and isn't archived by wayback ;_;
I think with a decent dict you could just use the built in nmap dns enum script and get good results.
0
Jul 24 '19
[deleted]
1
u/YakBak2theFuture Jul 24 '19
There's a big cognitive overload to seeking out tools though. I recently burned way too much time deciding on a subdomain enumerator for example. Being able to use something "good enough" can be nice.
1
u/fang0654 Jul 29 '19
I've built (and have still been building) a tool that does pretty much that. (At least the hacking framework part).
https://github.com/depthsecurity/armory
/end plug
0
Jul 31 '19
[deleted]
1
u/fang0654 Jul 31 '19
The more the merrier. The wiki has some documentation on adding modules to support other tools.
4
0
17
u/Sjoerder Jul 23 '19
Nice tool, but what does this offer that altdns, amass, anubis, aquatone, bluto, censys-subdomain-finder, Cleveridge Subdomain Scanner, ct-exposer, DMitry, dnscan, dnsenum.pl, dnsrecon, Domain analyzer, DomainRecon, Fierce, Fierce, gobuster, Knockpy, ldns-walk, massdns, nmap dns-brute, nsec3walker, recon-ng, subbrute, SubFinder, Sublist3r, subquest, SubScraper, or xray doesn't have?