SubDomainizer is a tool designed to find hidden subdomains present is either inline javascript or external javascripts present in the given URL. This tool also finds S3 buckets, cloudfront URL's and more from those JS files which could be interesting like S3 bucket is open to read/write, or subdomain takeover and similar case for cloudfront.
SubDomainizer can find URL's for following cloud storage services:
1. Amazon AWS services (cloudfront and S3 buckets)
2. Digitalocean spaces
3. Microsoft Azure
4. Google Cloud Services
5. Dreamhost
6. RackCDN.
SubDomainizer will also find secrets present in content of the page and javascripts files. Those secret finding depends on some specific keywords and Shannon Entropy formula. It might be possible that some secrets which searched by tool is false positive. This secret key searching is in beta and later version might have increased accuracy for search results.
- Clone SubDomainzer from git:
git clone https://github.com/nsonaniya2010/SubDomainizer.git
- Change the directory:
cd SubDomainizer
- Install the requirements:
sudo apt-get update
sudo apt-get install python3-termcolor python3-bs4 python3-requests python3-htmlmin python3-tldextract
- Enjoy the Tool.
Use following command to update to latest version:
git pull
| Short Form | Long Form | Description |
|---|---|---|
| -u | --url | URL in which you want to find (sub)domains. |
| -l | --listfile | File which contain list of URL's needs to be scanned. |
| -o | --output | Output file name in which you need to save the results. |
| -c | --cookie | Cookies which needs to be sent with request. |
| -h | --help | show the help message and exit. |
| -cop | --cloudop | Give file name in which you need to store cloud services results. |
| -d | --domain | Give TLD (eg. for www.example.com you have to give example.com) to find subdomain for given TLD. |
- To list help about the tool:
python3 SubDomainizer.py -h
- To find subdomains, s3 buckets, and cloudfront URL's for given single URL:
python3 SubDomainizer.py -u http://www.example.com
- To find subdomains from given list of URL (file given):
python3 SubDomainizer.py -l list.txt
- To save the results in (output.txt) file:
python3 SubDomainizer.py -u https://www.example.com -o output.txt
- To give cookies:
python3 SubDomainizer.py -u https://www.example.com -c "test=1; test=2"
Results before using facebook cookies in SubDomainizer:
Results after using facebook cookies in SubDomainizer:
This tools is licensed under the GNU GPL license. take a look at the LICENSE fore information about it.
Current version is 1.3
Want to donate for the improvement in features and tools? or Liked this tool? Donate Here
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent