Subdomain discovery · Python
usfx
Every well-known subdomain tool starts by querying a service on the internet. On an internal network that is exactly the thing you do not have.
- Python
- 1.2.0
- Cross-platform
Point it at an internal DNS server and it works from there. Twelve techniques, all of them offline:
DNS brute force · zone transfer (AXFR) · DNSSEC walking over NSEC and NSEC3 · record mining across MX, NS, TXT, SRV, SOA and CAA · reverse DNS sweep · CNAME chain analysis · subdomain permutation · recursive sub-subdomain enumeration · virtual host discovery · TLS certificate SAN extraction · subdomain takeover detection · web technology detection.
Three wordlists ship with it — roughly 500, 3,500 and 18,000 entries — and the
output has pipeline modes (subs, web, ips, json) so it chains into
whatever runs next instead of being parsed out of a report.