Subdomain Enumeration Python Packages

bbot

The recursive internet scanner for hackers. 🧡

theharvester

E-mails, subdomains and names Harvester - OSINT

bugscan-x

bughost scanner

reconninja

⚡ ReconNinja v8.2.1 — 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

graphinder

Escape Graphinder

knock-subdomains

Knockpy Subdomains Scan

python3-libraccoon

libraccon a library for high performance offensive security tool for reconnaissance based on raccoon scanner. This include performing DNS reconnaissance

subdominator

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

kickdomain

Kickdomain is a subdomain enumeration and takeover checker tool

dosuby

Dosuby is a tool developed in Python that aims to enumerate subdomains of a parent domain. It uses multiple techniques for enumeration, allowing for a comprehensive subdomain scan. Additionally, Dosuby has the option to scan the enumerated domains.

subfind3r

An improved version of Sublist3r, a python based Fast subdomains enumeration tool for penetration testers

pnk

Produce a combination of subdomains without repetitions - generates permutations P(n,k)

subdomains-lookup

Subdomains Lookup API client library for Python

subzuf

a smart DNS response-guided subdomain fuzzer

elixir-dns

Elixir is a fast multi-function DNS Enumeration, Subdomain Enumeration and Attack Surface Mapping tool.

probecon

Probe: This is a special tool for bug hunter for automated recon process smoothly.

domainia

Domainia helps to find subdomains, DNS records, IP addresses, SSL Certificates, HTTP info, etc. of domain by doing the passive reconnaissance.

subrake

🚀 A DNS automated scanner and tool 🖱️ (Zone Transfer, DNS Zone Takeover, Subdomain Takeover).

totalrecon

A lightweight Python tool for passive reconnaissance, including subdomain, email, and S3 bucket extraction, with AI-powered scanner for sensitive infrastructure mentions.

scanbugx

bughost scanner