Meet Subdominator, your new favourite CLI tool for detecting subdomain takeovers. It's designed to be fast, accurate, and dependable, offering a significant improvement over other available tools.
๐ Precision and speed are our goal. Subdominator delivers better results without the wait, see the benchmark and feature comparison below for details.
To quickly, get up and running, you can download the latest release for windows or linux. Alternatively, download it via CLI (remove .exe for linux version):
wget https://github.com/Stratus-Security/Subdominator/releases/latest/download/Subdominator.exe
To quickly check a list of domains, simply run:
Subdominator.exe -l subdomains.txt -o takeovers.txt
Or to quickly check a single domain, run:
Subdominator.exe -d sub.example.com
-d, --domain <domain> A single domain to check
-l, --list <list> A list of domains to check (line delimited)
-o, --output <output> Output subdomains to a file
-t, --threads <threads> Number of domains to check at once [default: 50]
-v, --verbose Print extra information
-eu, --exclude-unlikely Exclude unlikely (edge-case) fingerprints
--validate Validate the takeovers are exploitable (where possible)
--version Show version information
-?, -h, --help Show help and usage information
The tool was run across 1000 passively gathered subdomains:
A benchmark was run across ~100,000 subdomains to compare performance with other popular tools
Tool | Threads | Time Taken |
---|---|---|
Subdominator | 50 | 19 minutes, 8 seconds |
Subjack | 50 | 2 hours, 30 minutes, 2 seconds |
Subdover | 50 | 2 hours, 33 minutes, 27 seconds |
- Advanced DNS Matching: Supports DNS matching for CNAME, A, and AAAA records.
- Recursive DNS Queries: Performs in-depth queries to enhance accuracy and reduce false positives.
- Intelligent Domain Matching: Uses a custom
public_suffix_list.dat
for more effective domain matching. - Domain Registration Detection: Checks for unregistered domains, with a more reliable method compared to other tools.
- High-Speed Performance: Achieves faster results through intelligent DNS record matching.
- Vetted Ruleset: Includes a thoroughly reviewed and updated ruleset.
- Comprehensive Detection: Capable of identifying takeovers missed by other tools.
- Validation: Dynamic takeover validation modules to check beyond fingerprints.
Feature | Subdominator | Subjack | Subdover |
---|---|---|---|
Advanced DNS Matching | โ | โ | โ |
Recursive DNS Queries | โ | โ | โ |
Intelligent Domain Matching | โ | โ | โ |
Domain Registration Detection | โ | โ | โ |
High-Speed Performance | โ | โ | โ |
Vetted and Updated Ruleset | โ | โ | โ |
Comprehensive Detection | โ | โ | โ |
Custom Fingerprint Support | โ | โ | โ |
Validation | โ | โ | โ |
Fingerprints | 97 | 35 | 80 |
Got a suggestion, fingerprint, or want to chip in? We're all ears! Open a PR or issue โ this will keep subdominator on top! ๐