Subdomain Enumerator

Professional console subdomain enumeration for authorized security testing, bug bounty reconnaissance, asset discovery, and education.

Preview

Ethical Usage

This tool is intended only for domains and systems you own or have explicit permission to test. Unauthorized reconnaissance may violate laws, contracts, or service terms. The developer is not responsible for misuse.

Features

• crt.sh certificate transparency enumeration
• DNS brute-force enumeration with a configurable wordlist
• DNS over HTTPS resolution through Cloudflare, Google, or automatic fallback
• Optional local DNS resolution
• Wildcard DNS detection and likely wildcard filtering
• TXT, CSV, and JSON exports
• Interactive mode when launched without arguments
• Windows-friendly console output with optional ANSI colors
• Unit tests that mock or avoid external network dependencies

Console Example

[+] Target: example.com
[+] Loading wordlist...
[+] Loaded 58 unique prefixes
[*] Checking wildcard DNS...
[-] No wildcard DNS detected.
[*] Querying crt.sh...
[+] crt.sh returned 37 unique candidates.
[*] Starting DNS brute-force with 30 workers...

[FOUND] api.example.com
        A: 104.21.10.25
        Source: crt.sh, dns-bruteforce
        Resolver: cloudflare

Requirements

• Windows 10 or Windows 11
• Python 3.10 or newer
• Windows Terminal, PowerShell, or Command Prompt

Installation

git clone https://github.com/USERNAME/subdomain-enumerator.git
cd subdomain-enumerator
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
python subdomain_enumerator.py --help

For this generated project folder:

cd subdomain_enumerator
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
python subdomain_enumerator.py --help

Usage

python subdomain_enumerator.py example.com --crtsh
python subdomain_enumerator.py example.com --bruteforce
python subdomain_enumerator.py example.com --bruteforce --wordlist wordlists\default.txt
python subdomain_enumerator.py example.com --crtsh --bruteforce --doh cloudflare
python subdomain_enumerator.py example.com --all --threads 30 --export txt,csv,json

Launching without arguments opens the interactive menu:

python subdomain_enumerator.py

CLI Arguments

domain
--crtsh
--bruteforce
--all
--wordlist PATH
--threads NUMBER
--doh cloudflare|google|auto|off
--resolver doh|local|both
--record-types A,AAAA,CNAME
--timeout SECONDS
--retries NUMBER
--export txt|csv|json|txt,csv,json
--output DIRECTORY
--detailed-txt
--include-unresolved
--skip-wildcard-check
--verbose
--quiet
--no-color
--log-file
--allow-large-wordlist
--version

Enumeration Methods

crt.sh mode queries the public certificate transparency JSON endpoint and extracts subdomains from certificate name_value fields.

DNS brute-force mode combines each valid wordlist prefix with the target domain, resolves candidates, and keeps only candidates with DNS records. Prefixes can contain multiple labels, such as api.dev.

DNS Over HTTPS

DNS over HTTPS sends DNS queries through HTTPS instead of relying only on the local Windows resolver. Supported providers:

• Cloudflare: https://cloudflare-dns.com/dns-query
• Google: https://dns.google/resolve

Use --doh auto to try Cloudflare first and fall back to Google when needed. Use --resolver local for standard local DNS, or --resolver both to combine DoH and local results.

Export Formats

Exports are written to output by default with Windows-safe filenames and automatic deconflicting.

• TXT: one subdomain per line, or detailed lines with --detailed-txt
• CSV: spreadsheet-ready rows with semicolon-separated multi-value fields
• JSON: structured scan metadata, statistics, and full result records

Project Structure

subdomain_enumerator/
  subdomain_enumerator.py
  requirements.txt
  README.md
  LICENSE
  .gitignore
  wordlists/
    default.txt
  output/
    .gitkeep
  tests/
    test_domain_utils.py
    test_exporters.py
    test_dns_parser.py

Troubleshooting

• requests package is required: run pip install -r requirements.txt.
• crt.sh rate limited the request: wait and retry later, or use DNS brute-force mode.
• No results: verify authorization, spelling, DNS provider availability, and wordlist quality.
• Slow brute-force scans: reduce record types, lower retries, or use a smaller authorized wordlist.
• ANSI colors look wrong: run with --no-color.

Testing

python -m unittest discover -s tests