Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
subdomains.sh — A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash. | Kitploit
Tools/GitHubGitHub/enenumxela/subdomains.sh
ReconnaissanceInformation GatheringPenetration TestingSubdomain EnumerationDNS Analysis
GitHubenenumxela/subdomains.sh

subdomains.sh

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

View Repository
79124 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

subdomains.sh

Made with Bash Maintenance open issues closed issues license author

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

Resources

  • The Workflow
  • Installation
  • Usage
  • Credits
  • Contribution

The Workflow

Flow Chart

Installation

Run the installation script:

root@kitploit:~
curl -s https://raw.githubusercontent.com/hueristiq/subdomains.sh/main/install.sh | bash -

Or run in an ephemeral Docker container:

Clone the repository and run

root@kitploit:~
cd subdomains.sh
# Build the container image
./docker-subdomains.sh build

# After build, you can run the script with the same options listed above.
# Each run will run in a new container, and the container is destroyed after run
./docker-sudomains.sh -d example.com -r 1.1.1.1

# To destroy the container image if desired
./docker-subdomains.sh destroy

Usage

To display this script's help message, use the -h flag:

root@kitploit:~
subdomains.sh -h
root@kitploit:~

           _         _                       _                 _     
 ___ _   _| |__   __| | ___  _ __ ___   __ _(_)_ __  ___   ___| |__  
/ __| | | | '_ \ / _` |/ _ \| '_ ` _ \ / _` | | '_ \/ __| / __| '_ \ 
\__ \ |_| | |_) | (_| | (_) | | | | | | (_| | | | | \__  _\__ \ | | |
|___/\__,_|_.__/ \__,_|\___/|_| |_| |_|\__,_|_|_| |_|___(_)___/_| |_| v1.0.0

USAGE:
  subdomains.sh [OPTIONS]

OPTIONS:
   -d, --domain 			 domain to discover subdomains for *
   -r, --resolvers 			 list of DNS resolvers containing file *
       --skip-passive 			 skip passive discovery discovery
       --use-passive-tools 		 comma(,) separated passive tools to use
       --exclude-passive-tools 		 comma(,) separated passive tools to exclude
       --skip-active 			 skip active discovery discovery
       --skip-dictionary 		 skip discovery from dictionary DNS brute forcing
  -dW, --dictionary-wordlist 		 wordlist for dictionary DNS  brute forcing
       --skip-permutation 		 skip discovery from permutation DNS brute forcing
  -pW, --permutation-wordlist 		 wordlist for permutation DNS brute forcing
       --skip-dns-records 		 skip discovery from DNS records
       --skip-reverse-dns 		 skip discovery from reverse DNS lookup
   -o, --output 			 output text file
       --setup				 install/update this script & dependencies
   -h, --help 				 display this help message and exit

NOTE: options marked with asterik(*) are required.

HAPPY HACKING :)

Credits

Credit goes to the authors of the various tools I used in this script:

  • @OWASP for amass
  • @hakluke for hakrevdns
  • @d3mondev for puredns
  • @tomnonom for anew
  • @Edu4rdSHL for findomain
  • @shenwei356 for rush
  • @hueristiq for hqsubfind3r
  • @projectdiscovery for subfinder and httpx

Contribution

Issues and Pull Requests are welcome!

Download Tool