Create a simple tool scan subdomains with Python

Tram Ho

Scan subdomains are one of the testing test crawl stages. Doing manual searches of subdomains is sometimes difficult, so in this article I will guide you to write tools to make this easier.

Installing the job requests in python:

Regarding the implementation of this article, which is brute-forcing, we will try all subdomains in wordlist whenever receiving a response, it is a valid subdomain . Sometimes the scan does not get all the subdomains , this is completely normal because our library does not subdomains all valid subdomains of that target .

Import the necessary libraries:

  • The request used to send the request to the target and receive write the domain is valid or not.
  • urllib3 to format target .
  • threading makes multithreading run faster.
  • The queue is more convenient in multithreading.

target processing:

This function tries to process the input to get a hostname if it is invalid the program will automatically exit.

This function helps us to read all subdomains from wordlist , with splitlines() function in python will help separate all the lines in a string. This helps avoid the case that being unable to load wordlist causes program errors, making sure that you have selected the correct path of the wordlist file. You can refer to some wordlist about DNS on Google, Github …

The following is one of the main functions of the program:

For subdomains that have valid or not, we will send requests to that domain, whenever the feedback received, it is valid. Declare a global queue variable to get subdomains stored in the queue, loop until all subdomains are made to request, create a url with the subdomain taken from the queue and target we are targeting, and send requests to. url and get feedback results to process. If you can not connect to that url, skip it and print nothing because the subdomains are invalid, if you get a status code 200, you can connect to that subdomain and you can print it completely. all valid.

With single-threaded scanning programs, it is quite slow, for large word list , single-threaded runs can take a day, to be able to improve this you can refer to multithreading.

First add all the subdomain from the previously processed wordlist and put into the queue:

Then initialize and run with the number of threads input:


With the main function, just take the input and run.

Here is the result when running:

Full code:

Share the news now

Source : Viblo