subhijack - A fast and efficient subdomain hijacking scanner t

项目说明

SubHijack

A fast and efficient subdomain hijacking scanner that checks for takeo by matching HTTP response bodies against predefined service fingerprints.

Features

Installation

Using Go:

Pre-built Binaries:

From Source:

Usage

Basic Usage

Output Format

The default output format is:

Example:

Command-Line Flags

Core Options

| Flag | Short | Description | Default |
|------|-------|-------------|---------|
| --timeout | | Timeout in seconds for HTTP requests | 30 |
| --User-Agent | -H | Custom User-Agent header for HTTP requests | Chrome User-Agent string |
| --concurrency | | Number of concurrent subdomain checks | 50 |
| --fingerprints | | Custom path to fingerprints.json file | ~/.config/subhijack/fingerprints.json |
| -- | | Show information | false |
| -- | | Print and exit | false |
| --silent | | Silent mode (no banner) | false |
| --no-resume | | Disable resume; start fresh and ignore any existing resume.cfg | false |

Output Options

| Flag | Short | Description |
|------|-------|-------------|
| --json | | Output results in JSON format |
| --output | | Sa output results to a file |
| --nc | | Disable colored output |

Service Filtering

| Flag | Description | Example |
|------|-------------|---------|
| --es | Exclude services (case-sensiti) | --es "Cargo Collecti Cloud" |
| --onlycheck | Only check specific services (case-sensiti) | --onlycheck "Github, AWS/S3" |

Note: --es and --onlycheck cannot be used together.

Examples

Basic Scanning

Custom Timeout and Concurrency

Exclude Specific Services

Output with --:

Only Check Specific Services

Output with --:

JSON Output

JSON Output Format:

Sa to File

The --output flag:

Custom User-Agent

Custom Fingerprints File

Disable Colored Output

Silent Mode (No Banner)

Mode

output shows:

Configuration

Default Fingerprints Location

By default, subhijack stores fingerprints.json at:

Automatic Download

If the fingerprints.json file doesn't exist at the default location:
1. The ~/.config/subhijack/ directory is created automatically
2. fingerprints.json is downloaded from:

Custom Fingerprints

You can use a custom fingerprints.json file:

Fingerprints Format

The fingerprints.json file contains service fingerprints with the following structure:

Match Conditions

Protocol Fallback

When a URL is provided without a protocol scheme:
1. First attempt: Try https://
2. Fallback: If HTTPS fails, try http://
3. Skip: If both fail, move to the next domain

Example:

scanned=300000

项目信息

开发语言：Go

Star 数：44

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A fast and efficient subdomain hijacking scanner that checks for takeover vulnerabilities by matching HTTP response bodies against predefined service fingerprints.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。