High-Speed Subdomain Discovery Tool

A high-performance, asynchronous subdomain discovery tool written in C++ designed for security researchers and penetration testers. This tool leverages extreme parallelism to perform fast reconnaissance on large corporate networks.

Features

• Asynchronous DNS Resolution: High-speed DNS queries using c-ares library
• Certificate Transparency Scanning: Passive subdomain discovery from CT logs
• Search Engine Enumeration: Scraping from multiple search engines (Google, Bing, Yahoo, etc.)
• HTTP/HTTPS Validation: Async verification of discovered subdomains
• DNS Zone Transfer Attempts: Active reconnaissance techniques
• Multiple Output Formats: JSON, CSV, Plain text, XML, and HTML
• Extreme Parallelism: Configurable thread pool for maximum performance
• Rate Limiting: Built-in delays to avoid being blocked
• Comprehensive Filtering: Wildcard detection and result deduplication

Dependencies

• c-ares: Asynchronous DNS resolution
• libcurl: HTTP/HTTPS requests
• OpenSSL: SSL/TLS support
• nlohmann/json: JSON parsing and generation
• CMake: Build system (3.12+)
• C++17: Modern C++ features

Installation

macOS (using Homebrew)

# Install dependencies
brew install c-ares curl openssl nlohmann-json cmake

# Clone and build
git clone <repository-url>
cd cpp_subdomain_discovery
mkdir build && cd build
cmake ..
make -j$(nproc)

Ubuntu/Debian

# Install dependencies
sudo apt update
sudo apt install build-essential cmake libcares-dev libcurl4-openssl-dev libssl-dev nlohmann-json3-dev

# Clone and build
git clone <repository-url>
cd cpp_subdomain_discovery
mkdir build && cd build
cmake ..
make -j$(nproc)

CentOS/RHEL/Fedora

# Install dependencies
sudo dnf install gcc-c++ cmake c-ares-devel libcurl-devel openssl-devel json-devel

# Clone and build
git clone <repository-url>
cd cpp_subdomain_discovery
mkdir build && cd build
cmake ..
make -j$(nproc)

Usage

Basic Usage

# Simple subdomain discovery
./subdomain_discovery -d example.com

# Save results to file
./subdomain_discovery -d example.com -o results.json

# Use more threads for faster scanning
./subdomain_discovery -d example.com -t 200

# Output in different formats
./subdomain_discovery -d example.com -f csv -o results.csv
./subdomain_discovery -d example.com -f plain
./subdomain_discovery -d example.com -f html -o report.html

Advanced Usage

# Disable specific discovery methods
./subdomain_discovery -d example.com --no-ct --no-search

# Custom DNS servers
./subdomain_discovery -d example.com --dns-servers 8.8.8.8,1.1.1.1,9.9.9.9

# Enable DNS bruteforce with wordlist
./subdomain_discovery -d example.com --enable-bruteforce --wordlist common.txt

# Verbose output with progress
./subdomain_discovery -d example.com -v

# Custom timeouts
./subdomain_discovery -d example.com --dns-timeout 10 --http-timeout 15

Command Line Options

Required:
  -d, --domain DOMAIN        Target domain to scan

Options:
  -t, --threads NUM          Number of threads (default: 100)
  -o, --output FILE          Output file
  -f, --format FORMAT        Output format: json, csv, plain, xml, html (default: json)
  --dns-timeout SEC          DNS timeout in seconds (default: 5)
  --http-timeout SEC         HTTP timeout in seconds (default: 10)
  --dns-servers SERVERS      Comma-separated DNS servers (default: 8.8.8.8,1.1.1.1)
  --no-ct                    Disable Certificate Transparency scanning
  --no-search                Disable search engine enumeration
  --no-zone-transfer         Disable zone transfer attempts
  --no-http                  Disable HTTP validation
  --enable-bruteforce        Enable DNS bruteforce (requires wordlist)
  --wordlist FILE            Wordlist file for DNS bruteforce
  -v, --verbose              Verbose output
  -h, --help                 Show help message

Discovery Methods

1. Certificate Transparency Logs

Passively discovers subdomains by querying CT log databases:

• crt.sh
• CertSpotter
• Censys (with API key)
• Facebook CT API

2. Search Engine Enumeration

Scrapes search engines for subdomain mentions:

• Google
• Bing
• Yahoo
• DuckDuckGo
• Baidu
• Yandex
• Ask.com

3. DNS Zone Transfer

Attempts active reconnaissance:

• AXFR zone transfer attempts
• DNS walking with common subdomains
• SRV record enumeration
• TXT record enumeration
• Reverse DNS lookups

4. HTTP/HTTPS Validation

Verifies discovered subdomains:

• Async HTTP/HTTPS requests
• Status code detection
• Title extraction
• Server header analysis
• Response time measurement

Output Formats

JSON (Default)

{
  "metadata": {
    "total_found": 150,
    "alive_count": 89,
    "scan_time": "2024-01-15T10:30:00Z"
  },
  "results": [
    {
      "subdomain": "api.example.com",
      "is_alive": true,
      "ip_addresses": ["192.168.1.100"],
      "http_status": 200,
      "response_time_ms": 245,
      "title": "API Gateway",
      "server": "nginx/1.18.0",
      "source": "ct_logs"
    }
  ],
  "statistics": {
    "http_status_distribution": {"200": 45, "404": 12, "403": 8},
    "source_distribution": {"ct_logs": 67, "search_engines": 23}
  }
}

CSV

subdomain,is_alive,ip_addresses,http_status,response_time_ms,title,server,source
api.example.com,true,"192.168.1.100",200,245,"API Gateway","nginx/1.18.0","ct_logs"

Plain Text

Subdomain Discovery Results
==========================

Total found: 150
Alive: 89
Dead: 61

api.example.com [ALIVE] [200] [192.168.1.100] - API Gateway
admin.example.com [ALIVE] [403] [192.168.1.101] - Admin Panel
test.example.com [DEAD]

Performance Tuning

Thread Configuration

• Default: 100 threads
• Light scanning: 50-100 threads
• Aggressive scanning: 200-500 threads
• Maximum: 1000 threads (not recommended)

Rate Limiting

• Built-in delays between requests to avoid being blocked
• Configurable timeouts for DNS and HTTP operations
• Automatic retry mechanisms with exponential backoff

Memory Usage

• Efficient memory management with RAII
• Streaming output for large result sets
• Configurable result limits to prevent memory exhaustion

API Integration

Search Engine APIs

For better results and higher rate limits, configure API keys:

# Shodan API
export SHODAN_API_KEY="your_api_key"

# Censys API
export CENSYS_API_ID="your_api_id"
export CENSYS_API_SECRET="your_api_secret"

# VirusTotal API
export VIRUSTOTAL_API_KEY="your_api_key"

Wordlists

Create custom wordlists for DNS bruteforce:

# Example wordlist (common.txt)
www
mail
ftp
admin
test
dev
staging
api
blog
shop

Building from Source

Debug Build

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Debug ..
make -j$(nproc)

Release Build

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)

Static Build

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release -DSTATIC_BUILD=ON ..
make -j$(nproc)

Troubleshooting

Common Issues

1. DNS Resolution Failures

   • Check DNS server connectivity
   • Try different DNS servers
   • Increase DNS timeout

2. HTTP Connection Issues

   • Verify internet connectivity
   • Check firewall settings
   • Increase HTTP timeout

3. Rate Limiting

   • Reduce thread count
   • Increase delays between requests
   • Use different IP addresses

4. Memory Issues

   • Reduce thread count
   • Limit maximum results
   • Use streaming output

Debug Mode

# Enable verbose logging
./subdomain_discovery -d example.com -v

# Check DNS resolution
dig @8.8.8.8 example.com

# Test HTTP connectivity
curl -I https://example.com

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer

This tool is intended for authorized security testing and research purposes only. Users are responsible for ensuring they have proper authorization before scanning any domains or networks. The authors are not responsible for any misuse of this tool.

Acknowledgments

• c-ares library for high-performance DNS resolution
• libcurl for HTTP/HTTPS functionality
• nlohmann/json for JSON processing
• Certificate Transparency project for passive discovery
• Security research community for methodologies and techniques