SubdomainEnum

Bash wrapper for multiple subdomain enumeration scripts

Uses:

• Amass
• Turbolist3r
• Assetfinder
• OneForAll
• HTTProbe
• Chaos // you'll need an API key
• HTTPResponseChecker
• HTTPX

The script will run all scripts independently, and merge & clean all results in one file. It also supports enumeration of secondlevel subdomains such as subdomain.target.example.com.

Installation

git clone https://github.com/bluecanarybe/SubdomainEnum.git

Build the image with Docker

docker build -t subdomainenum .

Usage via Docker

Run Docker container replacing with your chaos API key as an environment variable and target

docker run -e CHAOS_KEY="$API_KEY_HERE"  -v $(pwd):/tmp subdomainenum ./subdomains.sh target.com