Sublist3r README

The project's README from github.com/aboul3la/Sublist3r. As one markdown file: README.md.

About Sublist3r

Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and Ask. Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS.

subbrute was integrated with Sublist3r to increase the possibility of finding more subdomains using bruteforce with an improved wordlist. The credit goes to TheRook who is the author of subbrute.

Screenshots

Sublist3r

Installation

git clone https://github.com/aboul3la/Sublist3r.git

Sublist3r currently supports Python 2 and Python 3.

Dependencies:

Sublist3r depends on the requests, dnspython and argparse python modules.

These dependencies can be installed using the requirements file:

c:\python27\python.exe -m pip install -r requirements.txt

sudo pip install -r requirements.txt

Alternatively, each module can be installed independently as shown below.

Requests Module (http://docs.python-requests.org/en/latest/)

c:\python27\python.exe -m pip install requests

sudo apt-get install python-requests

sudo yum install python-requests

sudo pip install requests

dnspython Module (http://www.dnspython.org/)

c:\python27\python.exe -m pip install dnspython

sudo apt-get install python-dnspython

sudo pip install dnspython

argparse Module

sudo apt-get install python-argparse

sudo yum install python-argparse

sudo pip install argparse

for coloring in windows install the following libraries

c:\python27\python.exe -m pip install win_unicode_console colorama

Usage

Short Form Long Form Description
-d --domain Domain name to enumerate subdomains of
-b --bruteforce Enable the subbrute bruteforce module
-p --ports Scan the found subdomains against specific tcp ports
-v --verbose Enable the verbose mode and display results in realtime
-t --threads Number of threads to use for subbrute bruteforce
-e --engines Specify a comma-separated list of search engines
-o --output Save the results to text file
-h --help show the help message and exit

Examples

python sublist3r.py -h

python sublist3r.py -d example.com

python sublist3r.py -d example.com -p 80,443

python sublist3r.py -v -d example.com

python sublist3r.py -b -d example.com

python sublist3r.py -e google,yahoo,virustotal -d example.com

Using Sublist3r as a module in your python scripts

Example

import sublist3r 
subdomains = sublist3r.main(domain, no_threads, savefile, ports, silent, verbose, enable_bruteforce, engines)

The main function will return a set of unique subdomains found by Sublist3r

Function Usage:

Example to enumerate subdomains of Yahoo.com:

import sublist3r 
subdomains = sublist3r.main('yahoo.com', 40, 'yahoo_subdomains.txt', ports= None, silent=False, verbose= False, enable_bruteforce= False, engines=None)

License

Sublist3r is licensed under the GNU GPL license. take a look at the LICENSE for more information.

Credits

Thanks

Version

Current version is 1.0

Sublist3r (aboul3la/Sublist3r)

Searching Database…

11.1K ·GitHub
Sublist3r
这是什么？Sublist3r 是一个 Python 工具，利用 OSINT（开源情报）枚举目标网站的子域名，帮助渗透测试人员和漏洞猎人收集他们所针对域名的子域名。
这只是一个命令行脚本，还是我也能在自己的代码里使用它？它主要是一个命令行 Python 脚本，但你也可以直接把它的主函数导入到自己的 Python 脚本中。
我该怎么让它运行起来？用 requirements 文件安装依赖（Windows 或 Linux 下使用 pip），然后运行类似 'python sublist3r.py -d example.com' 的命令，即可枚举某个域名的子域名。
运行之前需要先安装什么？它依赖 requests、dnspython 和 argparse 这几个 Python 模块，支持 Python 2.7.x 或 Python 3.4.x。
它查找子域名的方式有什么坑吗？结果依赖第三方来源（Google、Yahoo、Bing、百度、Ask、Netcraft、Virustotal、ThreatCrowd、DNSdumpster），因此覆盖范围取决于这些服务能否正常访问、是否屏蔽自动化查询；该项目目前仍处于 1.0 版本。
它在 Windows 和 Linux 上都能用吗？能，README 分别给出了 Windows 和 Linux（Ubuntu/Debian/Centos）的依赖安装说明；由于它是纯 Python 实现，也可以在 macOS 上运行。
它从哪些来源获取子域名？它会查询 Google、Yahoo、Bing、百度和 Ask 等搜索引擎，以及 Netcraft、Virustotal、ThreatCrowd、DNSdumpster 和 ReverseDNS。
它也能暴力枚举子域名吗？可以，-b 参数会启用内置的 subbrute 模块，使用改进的字典，基于暴力破解的方式发现子域名。
我能检查找到的子域名开放了哪些端口吗？可以，-p 参数会针对指定的 TCP 端口（例如 80 和 443）扫描发现的子域名。
我能在自己的 Python 脚本中调用 Sublist3r 吗？可以，你可以导入它的主函数，并传入 domain、savefile、ports、silent、verbose、enablebruteforce 和 engines 等参数，它会返回一个去重后的子域名集合。
What are similar projects?bbot, OneForAll, theHarvester, GhostTrack, Photon, spiderfoot, thc-hydra, maigret
Which topics is it in?wordlist, subdomain-enumeration, subdomain, bruteforce, security-testing, recon, information-gathering, reconnaissance, search-engine, osint, hacking-tool, gplv2
Creator
aboul3la
Size
1.1 MB
Stars
11.1K
Updated
CommitJul 29Release1.1Apr 06
Age
10y
Commits · 90 Days