subscan

fast passive subdomain enumeration and attack surface discovery tool.

queries certificate transparency logs (crt.sh), alienvault otx, and hackertarget to find subdomains without sending direct traffic to the target, resolves dns records concurrently, and probes http/https services for status codes and page titles.

features

• passive discovery: no direct packets sent to target during enumeration
• multi-source intelligence: crt.sh, alienvault otx, hackertarget
• concurrent dns resolution with configurable thread pool
• optional http/https prober for status codes, server headers, page titles, and latency
• rich terminal table formatting with colored status codes
• export to json, csv, or plain txt
• silent mode for pipeline integration (subscan example.com -s | httpx)
• zero external dependencies beyond rich

installation

git clone https://github.com/emirplus/subscan.git
cd subscan
pip install -e .

or run directly with python:

python -m subscan example.com

usage

basic scan:

subscan github.com

scan with http/https probing enabled:

subscan github.com --probe

only show resolving (active) subdomains:

subscan github.com --active-only

save results to json:

subscan github.com --probe --output results.json

silent mode (pipe to other tools):

subscan github.com --silent > subdomains.txt

interactive mode (prompt for target and options):

subscan

example output

subscan v0.1.0 - passive subdomain recon & attack surface discovery

[*] Starting passive discovery for github.com...
[*] Discovered 28 candidate subdomains from Certificate Transparency & OSINT
[*] Resolving DNS records (20 threads)...
[*] Probing active HTTP/HTTPS endpoints...

                      Discovered Assets for github.com (28 found)
┏━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━┓
┃ Subdomain           ┃ IP Addresses     ┃ Status ┃ Server     ┃ Title         ┃ Latency ┃
┡━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━┩
│ api.github.com      │ 140.82.121.6     │  200   │ GitHub.com │ -             │  42.1ms │
│ docs.github.com     │ 185.199.108.153  │  200   │ GitHub.com │ GitHub Docs   │  38.5ms │
│ gist.github.com     │ 140.82.121.4     │  200   │ GitHub.com │ Discover      │  45.2ms │
│ status.github.com   │ 185.199.111.153  │  301   │ -          │ Moved         │  31.0ms │
│ support.github.com  │ 185.199.109.153  │  200   │ GitHub.com │ GitHub Support│  39.0ms │
└─────────────────────┴──────────────────┴────────┴────────────┴───────────────┴─────────┘

╭─────────────────────────── Scan Summary ───────────────────────────╮
│ Total unique subdomains found: 28                                 │
│ Active resolving hosts: 24                                        │
│ HTTP reachable endpoints: 21                                      │
╰────────────────────────────────────────────────────────────────────╯

options

usage: subscan [-h] [-p] [-a] [-t THREADS] [-o OUTPUT] [-s] [-v] [domain]

positional arguments:
  domain                target domain (e.g. example.com)

options:
  -h, --help            show this help message and exit
  -p, --probe           probe http/https endpoints for status code & title
  -a, --active-only     only show subdomains that resolve to an ip
  -t, --threads THREADS number of concurrent resolver threads (default: 20)
  -o, --output OUTPUT   save output to file (.json, .csv, or .txt)
  -s, --silent          silent mode, prints only subdomains
  -v, --version         show program's version number and exit

license

MIT