seqhub/subrecon repository overview

⁠Subrecon

Subdomain Enumeration combining popular tools using one Docker Image.

⁠Tools Combined

• Amass https://github.com/OWASP/Amass⁠
• subfinder https://github.com/projectdiscovery/subfinder⁠
• Findomain https://github.com/Findomain/Findomain⁠
• assetfinder https://github.com/tomnomnom/assetfinder⁠
• GSAN https://github.com/franccesco/getaltname⁠
• Rapid7 Project Sonar https://blog.erbbysam.com/index.php/2019/02/09/dnsgrep/⁠
• massdns https://github.com/blechschmidt/massdns⁠
• puredns https://github.com/d3mondev/puredns⁠
• httprobe https://github.com/tomnomnom/httprobe⁠
• httpx https://github.com/projectdiscovery/httpx⁠

⁠Build Docker Container

git clone https://github.com/onvio/subrecon.git
cd subrecon
docker build -t subrecon .

⁠Run against target domain

docker run -v $(pwd)/reports:/var/reports:rw subrecon <domain>

Optional: subdomain bruteforce using built-in wordlist https://raw.githubusercontent.com/onvio/wordlists/master/common_subs_nl.txt⁠

docker run -v $(pwd)/reports:/var/reports:rw subrecon <domain> brute