Sudomy - Sudomy是一个子域枚举工具，用于收集

项目说明

Sudomy

![License]() ![Build Status]() ![]() ![Build]() ![Build]() ![Contributions Welcome]() ![Donate]()

Subdomain Enumeration & Analysis

<img width="935" alt="sudomy" src="

*Sudomy* is a subdomain enumeration 工具 to collect subdomains and analyzing domains performing ad automated reconnaissance (框架). This 工具 can also be used for OSINT (Open-源码 intelligence) acti.

Features !

##### For recent time, *Sudomy* has these 20 features:

Easy, light, fast and powerful. Bash script (controller) is a by default in almost all Linux distributions. By using bash script multiprocessing feature, all processors will be utilized optimally.

Subdomain enumeration process can be achieved by using active method or passive method

- Acti
- *Sudomy* utilize Gobuster tools because of its highspeed performance in carrying out DNS Subdomain Bruteforce attack (wildcard support). The wordlist that is used comes from combined SecList (Discover/DNS) lists which contains around 3 million entries

- Passi
- By e and selecting the good third-party sites/resources, the enumeration process can be optimized. More results will be obtained with less time required. *Sudomy* can collect data from these well-curated 22 third-party sites:

Test the list of collected subdomains and probe for working http or https servers. This feature uses a third-party 工具, httprobe.

Subdomain a test based on Ping Sweep and/or by getting HTTP status 代码.

The ability to detect (several subdomains which resolve to single IP Address). Sudomy will resolve the collected subdomains to IP addresses, then classify them if several subdomains resolve to single IP address. This feature will be very useful for the next penetration testing/bug bounty process. For instance, in port scanning, single IP address won’t be scanned repeatedly

Performed port scanning from collected subdomains/ IP Addresses

Testing Subdomain TakeO (CNAME Resolver, DNSLookup, Detect NXDomain, Check Vuln)

Taking Screenshots of subdomains default using gowitness or you can choice another screenshot tools, like (-ss webscreeenshot)

Identify technologies on websites (category,application,)

Detection urls, ports, title, content-length, status-代码, response-body probbing.

Smart auto fallback from https to http as default.

Data Collecting/Scraping open port from 3rd party (Default::Shodan), For right now just using Shodan [Future::Censys,Zoomeye]. More efficient and effective to collecting port from list ip on target [[ Subdomain > IP Resolver > Crawling > ASN & Open Port ]]

Collecting Juicy URL & Extract URL Parameter ( Resource Default::WebArchi, UrlScanIO)

Collect interesting path (api|.git|admin|etc), document (doc|pdf), ja (js|node) and parameter

Define path for outputfile (specify an output file when completed)

Check an IP is Owned by Cloudflare

Generate & make wordlist based on collecting url resources (wayback,urlscan,commoncrawl. To make that, we Extract All the paramater and path from our domain recon

Generate 网络 Graph Subdomain &

Report output in HTML & CS

Sending notifications to a slack channel

How Sudomy Works

How sudomy works or recon flow, when you run the best arguments to collect subdomains and analyze by doing automatic recon.

Recon Worfklow

This Recon Workflow Sudomy v1.1.8#dev

!Recon Workflow

Detail information

Detail information File Reconnaissance & Juicy Data

Publication

Sudomy: Information Gathering Tools for Subdomain Enumeration and Analysis - IOP Conference Series: Materials Science and Engineering, 771, 2nd International Conference on Engineering and Applied Sciences (2nd InCEAS) 16 No 2019, Yogyakarta, Indonesia

User Guide

Offline User Guide : Sudomy - Subdomain Enumeration and Analysis User Guide v1.0

Online User Guide : Subdomain Enumeration and Analysis User Guide - Up to date

Comparison

Sudomy minimize more resources when use resources (Third-Party Sites) By e and selecting the good third-party sites/resources, so the enumeration process can be optimized. The domain that is used in this comparison is *tiket.com*.

The following are the results of passi DNS testing of *Sublist3r v1.1.0, Subfinder v2.4.5*, and *Sudomy v1.2.0*.

<img width="935" alt="Untitled" src="

In here subfinder is still classified as very fast for collecting subdomains by utilizing quite a lot of resources. Especially if the resources used have been optimized (?).

For compilation results and , you can check here:

Sudomy

Subfinder

Sublist3r

When I have free time. Maybe In the future, sudomy will use golang too. If you want to contributes it's open to pull requests.

But it's shit! And your implementation sucks!

Yes, you're probably correct. Feel free to "Not use it" and there is a pull button to "Make it better".

Installation

*Sudomy* is currently extended with the following tools. Instructions on how to install & use the application are linked below.

To Download Sudomy From Github

Dependencies

*Sudomy* requires jq and GNU grep to run and parse. Information on how to download and install jq can be accessed here

Running in a Docker Container

Post Installation

API Key is needed before querying on third-party sites, such as and .

The API key setting can be done in sudomy.api file.

YOUR_WEBHOOK_URL is needed before using the slack notifications

The URL setting can be done in slack.conf file.

Usage

To use all 22 Sources and Probe for working http or https servers ():

To use one or more source:

To use all Sources Without :

To use one or more plugins:

To use all plugins: testing host status, http/https status 代码, subdomain takeover and screenshots.

Nmap,Gobuster,wappalyzer and wscat Not Included.

To create report in HTML Format

HTML Report Sample:

| Dashboard | Reports |
| ------------ | ------------ |
|!Index|!f|

To gnereate 网络 graph subdomain &

Graph Sample:
| nGraph |
| ------------ |
|!nGraph|

To use best arguments to collect subdomains, analyze by doing automatic recon and sending notifications to slack

Slack Notification Sample:
| Slack |
| ------------ |
|!Slacks|

Tools O

Youtube : Click here

Translations

Indonesia

English

Portuguese - Brazil

Changelog

All notable changes to this project will be documented in this file.

Alternative Best 工具 - Subdomain Enumeration

Subfinder - Projectdiscovery

Sublist3r - aboul3la

Findomain - Edu4rdSHL

Amass - OWASP

Credits & Thanks

Tom Hudson - Tomonomnom

OJ Reeves - Gobuster

ProjectDiscovery - Security Through Intelligent Automation

Thomas D Maaaaz - Webscreenshot

Dwi Siswanto - cf-checker

Robin - webanalyze

christophetd - Censys

Daniel Miessler - SecList

EdO - can-i-take-o

jerukitumanis - Docker Maintainer

NgeSEC - Community

Zerobyte - Community

Gauli(dot)Net - Lab Hacking Indonesia

missme3f - Raditya Rahma

Bugcrowd & Hackerone

darknetdiaries - Awesome Art

项目信息

开发语言：Shell

Star 数：2433

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Sudomy is a subdomain enumeration 工具 to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。