Example Usage
SubScraper Options: -debug Enable debug logging -update Update config file (Will remove existing entries) -config CONFIG Override default config location -silent Show subdomains only in output -threads THREADS, -T THREADS Max threads for enumeration (65*). -t TIMEOUT set connection timeouts (3*) -d DOMAIN, --domain DOMAIN Target domain input (domain, .txt, STDIN, etc. Module Options: -ls List SubScraper enumeration modules. -m MODULES Execute module(s) by name or group (all*). -module-only Execute modules only not brute force Bruteforce Options: -w WORDLIST Custom wordlist for DNS brute force. -ns NS Comma separated nameservers to use Enumeration Options: -r, -resolve Resolve IP address for each subdomain identified. -c, -cname Perform CNAME lookup for subdomain takeover checks -http Probe for active HTTP services. -http-port HTTP_PORT HTTP ports to check, comma separated (80,443*) Output Options: -nc, -no-color Disable color output -active Only
See also
dnsx
Open Source
Fast and multi-purpose DNS toolkit from ProjectDiscovery. Resolves domains, performs wildcard filter…
Certipy
Open Source
Offensive tool for Active Directory Certificate Services (AD CS) enumeration and abuse. Finds and ex…
Interactsh
Open Source
Out-of-band interaction gathering server. Generates unique collaboration URLs for detecting blind vu…
username-anarchy
Open Source
Kali
Username tools for penetration testing…
Shodan
Freemium
Search engine for internet-connected devices. Finds exposed servers, webcams, ICS/SCADA systems, dat…
UltimateCMSWordlists
Open Source
📚 An ultimate collection wordlists of the best-known CMS…