Domained - Multi Tool Subdomain Enumeration

A domain name enumeration tool
The tools contained in domained requires Kali Linux (preferred) or Debian 7+ and Recon-ng
domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output)

Initial Install:
  • domained tools: python3 --install
  • Python required modules: sudo pip install -r ./ext/requirements.txt

Other Dependencies:
  • ldns library for DNS programming:
    • sudo apt-get install libldns-dev -y
  • Go Programming Language:
    • sudo apt-get install golang
NOTE: This is an active recon – only perform on applications that you have permission to test against.

Tools leveraged:

Subdomain Enumeraton Tools:
  1. Sublist3r by Ahmed Aboul-Ela
  2. enumall by Jason Haddix
  3. Knock by Gianni Amato
  4. Subbrute by TheRook
  5. massdns by B. Blechschmidt
  6. Recon-ng by Tim Tomes (LaNMaSteR53)
  7. Amass by Jeff Foley (caffix)
  8. SubFinder by by Ice3man543

Reporting + Wordlists:

First Step:
Install Required Python Modules: sudo pip install -r ./ext/requirements.txt
Install Tools: sudo python3 --install

Example 1: python3 -d
Uses subdomain (Sublist3r (+subbrute), enumall, Knock, Amass, and SubFinder)

Example 2: python3 -d -b -p --vpn
Uses subdomain with seclist subdomain list bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall, and SubFinder), adds ports 8443/8080 and checks if on VPN

Example 3: python3 -d -b --bruteall
Uses subdomain with large-all.txt bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall and SubFinder)

Example 4: python3 -d --quick
Uses subdomain and only Amass and SubFinder

Example 5: python3 dom -d --quick --notify
Uses subdomain, only Amass and SubFinder and notification

Example 6: python3 -d --noeyewitness
Uses subdomain with no EyeWitness

Note: --bruteall must be used with the -b flag
Option Description
--install/--upgrade Both do the same function – install all prerequisite tools
--vpn Check if you are on VPN (update with your provider)
--quick Use ONLY Amass and SubFinder
--bruteall Bruteforce with JHaddix All.txt List instead of SecList
--fresh Delete old data from output folder
--notify Send Pushover or Gmail Notifications
--active EyeWitness Active Scan
--noeyewitness No Eyewitness
-d The domain you want to preform recon on
-b Bruteforce with subbrute/massdns and SecList wordlist
-s n Only HTTPs domains
-p Add port 8080 for HTTP and 8443 for HTTPS

  • Complete the ext/notifycfg.ini for Pushover or Gmail notifications. (Enable must be set to True)
  • Please see the Pushover API info here and instructions on how to allow less secure apps on your gmail account here

To-Do List
  • Multiple Domains
  • Notifications
  • Subdomains from censys
  • Subdomains from Shodan
  • Web Frontend/Dashboard
  • Add SubFinder

Thank You to Contributors

Major Updates
  • 07-15-2017: Updated to include error handling and updated reconnaissance techniques from Bugcrowd's LevelUp Conference (including subbrute/masscan and subdomain lists) - influenced by Jason Haddix's talk Bug Hunter's Methodology 2.0
  • 08-09-2017: Various fixes (+ phantomjs error), added --fresh option, removed redundant PyBrute folder from output and added pip requirements.txt
  • 08-15-2017: Added notification (--notify) option with Pushover or Gmail support
  • 08-18-2017: Moved repo from OrOneEqualsOne/reconned
  • 09-28-2017: Updated for Recon-ng dependency + Python3 changes
  • 06-20-2018: Added Amass and option for no EyeWitness
  • 10-12-2018: Added SubFinder

Domained - Multi Tool Subdomain Enumeration Domained - Multi Tool Subdomain Enumeration Reviewed by Zion3R on 8:00 AM Rating: 5