Subdomain Enumeration Python Packages

bbot

The recursive internet scanner for hackers. 🧡

theharvester

E-mails, subdomains and names Harvester - OSINT

bugscan-x

bughost scanner

vamp-easm

External Attack Surface Management — subdomain enum, port scan, TLS, diff tracking + Shodan Monitor alerts (CVEs & new ports)

knock-subdomains

Knock Subdomain Scan

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

subdominator

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

vamp-subdomain-takeover

VampSecure Labs — Subdomain Takeover Vulnerability Scanner

vamp-passive-recon

VampSecure Labs: Passive recon engine — subdomain enumeration + HTTP headers analysis

subx-recon

SubX is an open-source asset discovery framework that helps security professionals uncover and map internet-facing assets through subdomain enumeration and reconnaissance techniques.

astrarecon

A Linux-first, plugin-based recon workflow engine with DAG execution, persistent sessions, AI-ready exports, and Rich CLI.

reconninja

⚡ ReconNinja v10.6.0— 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.

graphinder

🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️

python3-libraccoon

libraccon a library for high performance offensive security tool for reconnaissance based on raccoon scanner. This include performing DNS reconnaissance

kickdomain

Kickdomain is a subdomain enumeration and takeover checker tool

dosuby

Dosuby is a tool developed in Python that aims to enumerate subdomains of a parent domain. It uses multiple techniques for enumeration, allowing for a comprehensive subdomain scan. Additionally, Dosuby has the option to scan the enumerated domains.

subfind3r

An improved version of Sublist3r, a python based Fast subdomains enumeration tool for penetration testers

webanalyzer-security

Open-source attack-surface scanner: subdomains, DNS, tech stack and vulnerabilities in one command. SARIF for GitHub Code Scanning, a GitHub Action, a web dashboard, and plugins that are one file each.

pnk

Produce a combination of subdomains without repetitions - generates permutations P(n,k)

bladerecon

Intelligence-driven reconnaissance framework for bug bounty hunters and security professionals.

harvester-windows

E-mails, subdomains and names Harvester - OSINT

subrake

🚀 A DNS automated scanner and tool 🖱️ (Zone Transfer, DNS Zone Takeover, Subdomain Takeover).

subzuf

a smart DNS response-guided subdomain fuzzer

oamx

Read the OWASP Amass asset database and pipe it into everything else. Zero dependencies, read-only, works across Amass v4 and v5.