Subrake

Subrake 🦅 A DNS automated scanner and tool Zone Transfer, DNS Zone Takeover, Subdomain Takeover. Background 📈 Subrake, initially started as a personal project of mine for subdomain enumeration is a now a detailed DNS scanning tool that can help you identify Zone Transfers , DNS Zone Takeover and...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

NtHiM

NtHiM - Super Fast Sub-domain Takeover Detection...

Sublist3r

About Sublist3r Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing,...

Subhunter

Subhunter A fast subdomain takeover tool Description: Subdomain takeover is a common vulnerability that allows an attacker to gain control over a subdomain of a target domain and redirect users intended for an organization's domain to a website that performs malicious activities, such as phishing...

ghostbuster

Table of Contents Table of Contents Ghostbuster The problem Project Features Installing Ghostbuster Using Ghostbuster Example Output Setting up your AWS accounts Setting up Cloudflare Optional Authors License Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources with...

Turbolist3r

Project Status Please note I am not actively supporting this project. I may return to subdomain research at some point but my security interests lie elsewhere at the moment and my time is divided among other things. If you find an issue feel free to send a PR or fork it into your own project...

Recon

👑 Recon 👑 The step of recognizing a target in both Bug Bounties and Pentest can be very time-consuming. Thinking about it, I decided to create my own recognition script with all the tools I use most in this step. All construction of this framework is based on the methodologies of @ofjaaah and...

s3dns

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

scriptkiddi3

Streamline your recon and vulnerability detection process with SCRIPTKIDDI3, A recon and initial vulnerability detection tool built using shell script and open source tools. How it works • Installation • Install with Docker • Usage • MODES • Important Notes | Webhook configurations • For Develope...

kanha

Kanha - A web-app pentesting suite written in rust 🦀 Installation ⦾ Subcommands ⦾ Contribute Kanha is a tool that can help you perform, a variety of attacks based on the target domain . With just kanha you can do, Fuzzing, Reverse dns lookup, common http response, subdomain takeover detection and...

subdosec

Subdosec Subdomain takeover scanner & reconnaissance tool. Install • Usage • Web Based • Contribution • Online scan • Acknowledgments Subdosec is a fast and accurate subdomain takeover scanner with no false positives, featuring a public database of vulnerable subdomains and detailed non-vulnerabl...

r3con

R3CON Multifunctional Web Recon & Vulnerability Scanner Tool r3con is a Multifunctional Web Recon & Vulnerability Scanner Tool and incredibly fast crawler that can find multiple vulnerabilitys and gather information. Check for vulnerabilities Reflected XSS Multi-threaded crawling Open-redirection...

Garud

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. I made this tool to automate my recon and save my time. It really give me headache always type such command and then wait to complete one command and I type oth...

domain-protect

domain-protect Domain Protect is now an OWASP project moved to: github.com/domain-protect/domain-protect...

dnsReaper

DNS Reaper DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire D...

robusto

RobuSTO 💥 Robust-Subdomain-Takeover 💥 Get a list of domains and search for subdomain takeovers. How is it different from other tools? This tools was build around the idea of automating the process, and allow blue-teams to use it to scan their own assets. For example, scan all my organization's...

bug-bounty-reports-desai-vinayak

🧩 Bug Bounty Reports — Desai Vinayak 🔒 Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. 📁 Contents 📂 reports/ — PDF, DOCX, and...

tko-subs

tko-subs このツールで可能なこと: サブドメインが乗っ取られる可能性があるかどうかを確認します。以下のような場合があります: CMSプロバイダー（Heroku、Github、Shopify、Amazon S3、Amazon CloudFrontなど）へのぶら下がったCNAMEが存在し、それが乗っ取られる可能性がある場合 存在しないドメイン名を指すぶら下がったCNAMEがある場合 攻撃者がサブドメインのDNSレコードを制御するために乗っ取ることができるネームサーバーを指す、1つ以上の誤った/タイポされたNSレコードがある場合 フラグ -takeover...

second-order

Second Order Webアプリケーションをクロールし、特定のルールに一致するか特定の方法で応答するURL（およびその他のデータ）を収集することで、セカンドオーダーサブドメイン乗っ取り をスキャンします。 インストール バイナリから リリースページからプリビルドバイナリをダウンロードし、解凍してください。 ソースから Goバージョン1.17を推奨します。 root@kitploit: go install -v github.com/mhmdiaa/second-order@latest Docker root@kitploit: docker pull...