Subdosec
Subdomain takeover scanner & reconnaissance tool.
Install • Usage • Web Based • Contribution • Online scan • Acknowledgments
Subdosec is a fast and accurate subdomain takeover scanner with no false positives, featuring a public database of vulnerable subdomains and detailed non-vulnerable metadata (IP, CNAME, title, and status code) for reconnaissance.
Install or upgrade subdosec
pipx install git+https://github.com/xcapri/subdosec.git
pipx upgrade subdosec
Subdosec automatically detects its setup state, installs any missing dependencies, and boots the matching engine server on your first scan transparently.
[WARNING] Do not takeover all subdomains in test.txt, let everyone use that for demos.
[INFO] Also check the Release section. You can find interesting info.
$ subdosec
Expand full help flags
_____ __ __
/ ___/__ __/ /_ ____/ /___ ________ _____
\__ \/ / / / __ \/ __ / __ \/ ___/ _ \/ ___/
___/ / /_/ / /_/ / /_/ / /_/ (__ ) __/ /__
/____/\__,_/_.___/\__,_/\____/____/\___/\___/
Local API : ON (port 8450)
Gemini Key : SET
Fingerprints : CACHED
Usage:
cat targets.txt | subdosec Scan subdomains (public mode)
cat targets.txt | subdosec -lm Scan & save results locally
subdosec -sfid List available fingerprints
subdosec -unai undetect.json AI analysis of undetected subs
subdosec -uf Update fingerprints
Scan Options:
-mode private|public Mode of operation (default: public)
-vo VULN only: hide UNDETECT messages
-pe Print errors during scan
-lf github.io Lock to specific fingerprints (-lf surge.sh,github.io)
-pf /path/to.json Use private/local fingerprint file
-t 20 Set thread count (default: 10)
-v Show scan progress counter
-unai /path/to/undetect.json AI analysis of undetected subdomains
Output Options:
-lm Local mode: save vulns & undetect locally
-o /path/to/dir Save vuln results to custom path
-lu /path/to/dir Save undetect results to custom path
-su Skip sending undetect to server
Config & Tools:
-initkey YOUR_KEY Initialize private API key
-subfng finger.json Submit fingerprint to admin
-uf Update fingerprints from server
-sfid View all available fingerprint IDs
-ks Kill background server
Dashboard:
-web [PORT] Launch web dashboard (default port: 8443)Prepare list
Support without protocol
cat list
https://careers.rotacloud.com
http://creators.thinkorion.com
https://docs.polygon-nightfall.technology
a.anchorsawaytpt.com
help.oceges.com
CMD 1
Skip stored undetect to server & save localy
cat test.txt | subdosec -lm
https://subdosec.vulnshot.com [UNDETECT]
http://feedback.bazoom.com [sleekplan.com] [VULN] [SAVED]
http://demodev.destinojet.co [meteor.com] [VULN] [SAVED]
http://creators.thinkorion.com [UNDETECT]
https://www.www.savillerow.status.lnt.cl [ohdear.app] [VULN] [SAVED]
https://careers.rotacloud.com [gohire.io] [VULN] [SAVED]
https://careers.rotacloud.com [gohire.io] [VULN] [SAVED]
https://ai.yooture.com [UNDETECT]
https://help.oceges.com [UNDETECT]
http://ftp.thiagolima.com [surge.sh] [VULN] [SAVED]
VULN DIRECTORY : /home/alice/.subdosec/vulns
UNDETECT FILE : /home/alice/.subdosec/undetect/undetect.json
Read output
~$ ls /home/alice/.subdosec/vulns
gohire.io_tko.txt meteor.com_tko.txt ohdear.app_tko.txt sleekplan.com_tko.txt surge.sh_tko.txt
~$ cat /home/alice/.subdosec/vulns/gohire.io_tko.txt
careers.rotacloud.com
Read undetect & auto analys new potential vuln with -unai
cat /home/alice/.subdosec/undetect/undetect.json
[
{
"title": "No title found",
"status_code": 404,
"redirect_url": "No redirects",
"cname_records": [
"cname.redacted.com"
],
"a_records": [
"76.76.21.98",
"76.76.21.241"
],
"subdomain": "try.redacted.com",
"rootdomain": "redacted.com"
},
{
"title": "No title found",
"status_code": 200,
"redirect_url": "No redirects",
"cname_records": [
"cname.fermat.shop"
],
"a_records": [
"216.150.16.129",
"216.150.1.129"
],
"subdomain": "get.redacted.com",
"rootdomain": "redacted.com"
}
]
subdosec -unai /home/pd/.subdosec/undetect/undetect.json
[INFO] PURE UNDETECTED 0 | Subdomains are not detected as vulnerable even though they have passed the subdosec scan..
[INFO] Analyzing 8 items in 2 batches.
[INFO] Progress: 5/8 data analyzed.
NEW POTENTIAL :
Domain : try.redacted.com
CNAME : cname.redacted-service.com
A Record : 76.76.21.98, 76.76.21.241
Takeover : NOT
Reason : The redacted-service custom domain setup guide explicitly states the requirement of adding a TXT record (e.g., 'redacted-service-verification=<your_site_id>') for domain ownership verification. The presence of a TXT record verification step makes it not vulnerable.
Reference: https://www.redacted-service.com/blog/how-to-setup-custom-domain/
================================================================================
Domain : get.redacted.com
CNAME : cname.fermat.shop
A Record : 216.150.16.129, 216.150.1.129
Takeover : POSSIBLE
Reason : The service uses a static CNAME (cname.fermat.shop) for custom domain setup. Publicly available documentation for Fermat's custom domain setup does not clearly specify a requirement for a TXT record or any dynamic verification method for domain ownership. Without such verification, a static CNAME makes the subdomain potentially vulnerable if the corresponding Fermat account is deleted or becomes unlinked.
Reference: https://fermat.shop/
================================================================================
CMD 2
Using root domain & pipeline subdomain finder tool like (subfinder, assetfinder, amass, etc)
cat list
example.com
cat list | subfinder -silent | subdosec -lm
https://subdosec.vulnshot.com [UNDETECT]
http://feedback.bazoom.com [sleekplan.com] [VULN] [SAVED]
http://demodev.destinojet.co [meteor.com] [VULN] [SAVED]
http://creators.thinkorion.com [UNDETECT]
https://www.www.savillerow.status.lnt.cl [ohdear.app] [VULN] [SAVED]
https://careers.rotacloud.com [gohire.io] [VULN] [SAVED]
https://careers.rotacloud.com [gohire.io] [VULN] [SAVED]
https://ai.yooture.com [UNDETECT]
https://help.oceges.com [UNDETECT]
http://ftp.thiagolima.com [surge.sh] [VULN] [SAVED]
VULN DIRECTORY : /home/alice/.subdosec/vulns
UNDETECT FILE : /home/alice/.subdosec/undetect/undetect.json
CMD 3
(Forward result to notify)
cat list | subdosec -lm -vo | notify -silent
https://careers.rotacloud.com [100.00%] [gohire.io] [VULN] [SAVED]
CMD 4
Use private fingerprint, this flag will auto merge public + priv fingerprint
Expand full help flags
cat priv8.json
{
"fingerprints": [
{
"fid": 0,
"name": "Subdomain takeover - Pagedeck",
"rules": {
"cname": "cname.pagedeck.com",
"status_code": "404",
"in_body":"This page could not be found."
},
"status_fingerprint": 0,
"reference": "https://docs.pagedeck.com/getting-started/connecting-a-subdomain",
"service": "pagedeck.com",
"logo_service": "https://i.ytimg.com/vi/DY76Tjf1m-8/maxresdefault.jpg"
},
add more
]} echo try.hugsleep.com | subdosec -pf privfinger.json -o testpriv -lu okgaslu
_____ __ __
/ ___/__ __/ /_ ____/ /___ ________ _____
\__ \/ / / / __ \/ __ / __ \/ ___/ _ \/ ___/
___/ / /_/ / /_/ / /_/ / /_/ (__ ) __/ /__
/____/\__,_/_.___/\__,_/\____/____/\___/\___/
https://try.hugsleep.com [pagedeck.com] [VULN] [SAVED]
VULN DIRECTORY : /home/pd/tko/testpriv
UNDETECT FILE : /home/pd/tko/okgaslu/undetect.json
CMD 5
Launch the local web dashboard to inspect, search, filter, and export results
subdosec -web
# Or specify a custom port:
subdosec -web 9000
Knowing the function of the subdosec web, here you can use the https://subdosec.vulnshot.com/result/undetected feature as a reconnaissance, to find out IP, CNAME, TITLE, STATUS CODE, etc. as further information or even to find new takeover subdomains
It has the same function as undetect.json, the difference is that you and other people share it with each other.
For example, you search for a site that is not detected as vulnerable by subdosec with the keyword 404, and there is information on cname.gohire.io and the title GoHire, which if you search on Google, there is no article information about subdomain takeover on the gohire service.
After you find a new subdomain takeover, either manually or automatically (using -unai), you can submit the data to us using the subdosec -subfng command.
Dynamically you can use this element for rules :
title, cname, status_code, in_body, a_record, redirect
cat newvuln.json
{
"name": "Subdomain takeover - GoHire",
"rules": {
"cname": "custom.gohire.io",
"in_body": "Page not found",
"status_code": "404"
},
"status_fingerprint": 0,
"reference": "https://help.gohire.io/en/articles/3385288-setting-up-a-custom-domain",
"service": "gohire.io",
"logo_service": "https://gohire-website.s3.amazonaws.com/img/logos/gh-logo-main.gif"
}
subdosec -subfng newvuln.json
[Info] Submitting fingerprint ...
Imported fingerprint data successfully
If you are not a person with a security background, maybe a web-dev/programmer and not familiar with cli tools. you can use the web version to scan all your subdomains with a max of 10 subdomains per scan.
The predecessor tools that inspired the creation of subdosec tools.
- can-i-take-over-xyz
- can-i-take-over-dns
- SubOver
- subjack
- nuclei-templates/http/takeovers
- The bug bounty community for inspiration and feedback.
subdosec is distributed under MIT License