🔍 Subdomain Enumeration Toolkit

Passive subdomain discovery with DNS validation, HTTP probing, and takeover detection.

Built for security researchers, bug bounty hunters, and penetration testers who need fast, reliable subdomain enumeration without noisy brute-force traffic.

---

✨ What it does

For each target domain the Actor:

1. Collects subdomains from 5 passive OSINT sources simultaneously
2. Resolves DNS — finds the live IP address for each subdomain
3. Probes HTTP/HTTPS — checks status code, page title, server header, and redirects
4. Detects takeover risks — flags subdomains pointing to unclaimed cloud services

---

🗂️ Sources

Source	Type	API key needed
Certspotter	Certificate Transparency logs	No
HackerTarget	Passive DNS archive	No
RapidDNS	Passive DNS archive	No
AlienVault OTX	Threat intelligence	Free (optional)
URLScan.io	Internet scan archive	No

All sources are passive — no direct scanning, no brute-force, no traffic to the target.

---

🛡️ Takeover detection

Automatically checks 30+ services for dangling CNAME records:

GitHub Pages · Heroku · AWS S3 · AWS CloudFront · Azure Web Apps · Azure Blob · Netlify · Webflow · Shopify · Fastly · Zendesk · Ghost · GitBook · WP Engine · Surge · Bitbucket · Tumblr · and more.

Each finding is labeled as high (dangling — no IP) or medium (resolves but CNAME points to a cloud service).

---

⚙️ Input

Field	Type	Default	Description
domains	string[]	—	Required. Target domains, e.g. example.com
otxApiKey	string	—	OTX API key for extra results.Get free key →
doResolve	boolean	true	Resolve DNS A records
doProbe	boolean	true	HTTP/HTTPS probe per live host
doTakeover	boolean	true	Subdomain takeover detection
probeTimeoutSecs	integer	7	Timeout per HTTP probe request
maxConcurrency	integer	30	Parallel DNS/HTTP workers
useApifyProxy	boolean	false	Route probes through Apify residential proxies

---

📦 Output

Each subdomain is saved as one row in the dataset:

{
  "domain": "tesla.com",
  "subdomain": "api.tesla.com",
  "sources": ["Certspotter", "RapidDNS"],
  "dns_resolves": true,
  "dns_ip": "23.62.104.69",
  "http_status": 200,
  "http_title": "Tesla API",
  "http_server": "nginx",
  "http_redirect": "",
  "is_live": true,
  "takeover_risk": "none",
  "takeover_service": "",
  "scanned_at": "2026-05-30T12:00:00+00:00"
}

takeover_risk values: none / medium / high

A RUN_METADATA record is also saved to the Key-Value Store:

{
  "total_domains": 1,
  "total_subdomains": 308,
  "live_http": 291,
  "takeover_high": 2,
  "takeover_medium": 5,
  "scanned_at": "2026-05-30T12:00:00+00:00"
}

---

💡 Example use cases

• Bug bounty recon — map the full attack surface before starting an engagement
• Penetration testing — discover forgotten staging, dev, and internal subdomains
• Takeover hunting — find orphaned subdomains pointing to unclaimed Heroku apps, S3 buckets, GitHub Pages
• Competitor intelligence — understand a company's infrastructure layout
• Attack surface monitoring — run on a schedule to catch newly created subdomains

---

💰 Pricing

This Actor uses Pay-Per-Event billing:

Event	Cost
Actor start	$0.05 flat per run
Per discovered subdomain	$0.001 per subdomain

Example: scanning tesla.com and finding 308 subdomains costs $0.05 + 308 × $0.001 = $0.358.

---

🔑 OTX API key (recommended)

AlienVault OTX significantly increases subdomain coverage — in tests it added 100+ unique subdomains on top of other sources.

1. Register free at otx.alienvault.com
2. Go to Settings → API Key
3. Paste the key into the otxApiKey input field

Free tier: 10,000 requests/hour.

---

🖥️ Local testing

# Install dependencies
pip install -r requirements.txt

# Create input
mkdir -p storage/key_value_stores/default
cat > storage/key_value_stores/default/INPUT.json << 'JSON'
{
  "domains": ["example.com"],
  "otxApiKey": "your_key_here",
  "doProbe": true,
  "doTakeover": true
}
JSON

# Run
python src/main.py

Results are saved to storage/datasets/default/.

---

📋 Memory requirements

• 512 MB — sufficient for most single-domain runs
• 1024 MB — recommended for 10+ domains or large domains with 500+ subdomains

---

⚠️ Legal notice

Use only on domains you own or have explicit written permission to test. The author is not responsible for misuse. This tool performs passive reconnaissance only — it does not send any traffic directly to the target.