subDomainsBrute
A high-performance DNS brute-force tool for enumerating subdomains during penetration testing.
What is subDomainsBrute?
subDomainsBrute is a DNS brute-force tool used by penetration testers and security researchers to discover subdomains of a target domain. It works by testing a large list of possible subdomain names against DNS servers to identify valid entries, which is a critical step in the reconnaissance phase of security assessments. The tool is optimized for high-speed scanning using a multi-process and coroutine architecture.
Penetration testers, security researchers, and red teamers who need to perform thorough subdomain enumeration as part of vulnerability assessments or attack surface mapping.
Developers choose subDomainsBrute for its exceptional speed, handling up to 3000 domains per second, and its robust features like wildcard handling and HTTPS certificate parsing, which provide more comprehensive results compared to basic enumeration tools.
Overview
A fast sub domain brute tool for pentesters
Use Cases
Best For
- Performing fast subdomain enumeration during penetration testing engagements
- Security reconnaissance to map an organization's attack surface
- Identifying overlooked subdomains that could expose vulnerabilities
- Brute-forcing subdomains with custom or extensive wordlists
- Handling wildcard DNS configurations during scans
- Extracting additional domains from HTTPS certificates for expanded discovery
Not Ideal For
- Environments with strict DNS rate limiting or where aggressive scanning could trigger security alerts
- Teams needing an all-in-one reconnaissance suite with integrated web crawling or port scanning
- Users unfamiliar with command-line tools or requiring a graphical interface for ease of use
- Scenarios where passive subdomain enumeration is preferred to avoid detection in sensitive networks
Pros & Cons
Pros
Achieves up to 3000 domains per second using multi-process and coroutine architecture, making it exceptionally fast for brute-force enumeration as highlighted in the README.
Includes wildcard detection and an option to force scan after failure, reducing false positives and improving accuracy in subdomain discovery.
Extracts additional domain names from HTTPS certificates, expanding coverage beyond brute-forcing for more comprehensive results.
Works on Python 2.7 and 3.5+, with specific optimizations for Windows using Proactor event loops, ensuring broad usability across systems.
Cons
Requires specific dnspython versions (e.g., 2.2.1 for Python3) and has compatibility notes for different Python versions, leading to potential setup complexities and dependency conflicts.
High concurrency with multiple processes and threads can consume significant CPU and network resources, potentially slowing down other system tasks or leading to rate limiting by DNS servers.
Focuses solely on DNS enumeration without integrated features like passive reconnaissance or additional security checks, which may require combining with other tools for full assessments.
Frequently Asked Questions
Related Projects
Sublist3rFast subdomains enumeration tool for penetration testers
AQUATONEA Tool for Domain Flyovers
domain_analyzerAnalyze the security of any domain by finding all the information possible. Made in python.
Certificate TransparencyAuditing for TLS certificates.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.