Home Posts Projects About Service

Subdomain enumerator CLI tool

#Python #DNS #HTTP #Reconnaissance #Concurrency 2026/08/20 00:00:00
Table of contents
  1. Overview
  2. Current features
  3. Example usage
  4. What I learned
  5. Current status and next steps

Overview

This project is a wordlist-based subdomain enumerator built to explore DNS resolution, concurrent network requests, HTTP probing, HTML parsing, and basic technology fingerprinting.

Given a root domain and a wordlist, the tool constructs candidate hostnames and checks each one concurrently. When an A record resolves, it attempts HTTPS first and falls back to HTTP, then collects information that helps distinguish the discovered services.

Current features

  • Command-line arguments for the root domain, wordlist, and worker count.
  • Concurrent candidate processing with ThreadPoolExecutor.
  • DNS A-record resolution and collection of returned IPv4 addresses.
  • HTTPS probing with HTTP fallback.
  • HTTP status, response length, page title, and redirect-location collection.
  • Lightweight technology fingerprinting using response headers, HTML signatures, and cookie names.
  • JSON-based fingerprints that can be expanded without changing the scanner logic.

The current fingerprint file contains signatures for technologies including Cloudflare, Nginx, Apache, WordPress, Next.js, Nuxt, Drupal, Vue, PHP, and Java.

Example usage

python sub-scanner.py \ 
    --domain example.com \ 
    --wordlist wordlists/mini-wordlist.txt \ 
    --threads 20

For each responsive candidate, the tool prints its DNS record type, IP addresses, HTTP response details, redirect target, and any matched technology signatures.

What I learned

  • How DNS answers differ from HTTP availability.
  • Why discovery and probing should be treated as separate stages.
  • How threads improve workloads dominated by DNS and network latency.
  • How response headers, cookies, and HTML can provide technology clues.
  • Why fingerprints are indicators rather than definitive proof of a technology.
  • How redirects and alternate schemes affect recon results.

Current status and next steps

The main discovery, probing, and fingerprinting pipeline is implemented. Remaining work includes better handling when both HTTP schemes fail, wildcard-DNS detection, quieter error reporting, case-insensitive and version-tolerant header fingerprints, redirect controls, structured JSON or CSV output, and tests for the fingerprinting logic.

This tool is intended only for domains I own or have explicit permission to assess.