MrCl0wnLab/SimpleReconSubdomain

# SimpleReconSubdomain v2 

Passive and active subdomain enumeration tool for OSINT and reconnaissance workflows. Built with async Python - queries **50 sources** (39 passive + 11 active) in parallel with no external shell dependencies. Techniques inspired by **subfinder**, **amass**, **puredns** and **subjack**: multi-probe wildcard detection, DNSSEC NSEC zone walking, TLS SAN extraction, SRV record mining, two-pass trusted-resolver validation, recursive enumeration, HTML/JS crawling with sourcemap mining, CAA record mining, robots.txt/sitemap harvesting, secondary NS brute-force, ASN-based PTR sweep, IP/cloud provider detection, wordlist learning from discovered names, and subdomain-takeover fingerprinting. Author: MrCl0wn Blog: https://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab ## WARNING +------------------------------------------------------------------------------+ | [!] Legal disclaimer: Usage of SimpleReconSubdomain for attacking | | targets without prior mutual consent is illegal. | | It is the end user's responsibility to obey all applicable | | local, state and federal laws. | | Developers assume no liability and are not responsible for any misuse or | | damage caused by this program. | +------------------------------------------------------------------------------+ ## Table of Contents - [Installation](#installation) - [API Keys](#api-keys) - [Usage](#usage) - [Profiles](#profiles) - [Run-Config Presets](#run-config-presets) - [Passive vs Active Modules](#passive-vs-active-modules) - [Sources](#sources) - [DNS Brute-force](#dns-brute-force) - [Wordlist Learner - Pattern-derived candidates](#wordlist-learner--pattern-derived-candidates) - [TLD Brute-force](#tld-brute-force) - [Extras - External Hosts, IPs and URLs](#extras--external-hosts-ips-and-urls) - [Network Mapping - Graph JSON and HTML visualization](#network-mapping--graph-json-and-html-visualization) - [Markdown Report](#markdown-report) - [Database - SQLite Persistence](#database--sqlite-persistence) - [Continuous Monitoring - --watch](#continuous-monitoring--watch) - [Advanced Techniques](#advanced-techniques) - [Subdomain Takeover Detection](#subdomain-takeover-detection) - [Output Formats](#output-formats) - [Chaining with Other Tools](#chaining-with-other-tools) - [Creating a New Module](#creating-a-new-module) ## Installation git clone https://github.com/MrCl0wnLab/SimpleReconSubdomain cd SimpleReconSubdomain pip install -r requirements.txt **Dependencies** (`requirements.txt`): | Package | Purpose | |---|---| | `httpx[socks]` | Async HTTP client for all passive sources and resolver URL download (`[socks]` enables `--proxy socks5://`) | | `aiodns` | Async DNS resolver for brute-force and validation | | `dnspython` | Zone transfer (AXFR), DNS record mining, NSEC zone walking, SRV enumeration | | `beautifulsoup4` | HTML parsing for the `spider` active source (``, ``, `