🔍 Subdomain Finder

A fast, multi-threaded subdomain discovery tool built with Python. Efficiently scans domains using wordlists to identify accessible subdomains.

✨ Features

• ⚡ Multi-threaded scanning - Up to 50 concurrent requests for maximum speed
• 🔄 Automatic retry mechanism - Handles temporary failures gracefully
• 🎯 Connection pooling - Optimized HTTP session management
• 📊 Real-time progress - Live status updates during scanning
• 🛡️ Error handling - Robust exception management
• 💻 User-friendly - Interactive CLI interface

🚀 Quick Start

Prerequisites

• Python 3.8 or higher
• pip

Installation

# Clone the repository
git clone https://github.com/emircanmurat/SubHunter.git
cd SubHunter

# Create virtual environment
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Download wordlist
curl -o subdomains-top1million-5000.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt

Usage

python main.py

Then enter your target domain when prompted:

==================================================
     SUBDOMAIN FINDER
==================================================

[?] Enter target domain (e.g., google.com): example.com

📁 Project Structure

SubHunter/
├── .gitignore                          # Git ignore rules
├── main.py                             # Main application
├── requirements.txt                    # Python dependencies
├── subdomains-top1million-5000.txt    # Wordlist (download separately)
└── README.md                          # This file

⚙️ Configuration

You can adjust scanning parameters in main.py:

# Change number of concurrent threads (default: 50)
find_subdomains(target_input, wordlist, max_workers=100)  # More aggressive

# Change timeout (in create_session function)
response = session.get(url, timeout=5)  # Default: 5 seconds

🔧 Advanced Usage

Using Different Wordlists

Download larger wordlists from SecLists:

# 20,000 subdomains (~400KB)
curl -o subdomains-top1million-20000.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-20000.txt

# 110,000 subdomains (~2MB)
curl -o subdomains-top1million-110000.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-110000.txt

Then update the wordlist path in main.py:

wordlist = "subdomains-top1million-20000.txt"

📊 Example Output

==================================================
     SUBDOMAIN FINDER
==================================================

[?] Enter target domain (e.g., google.com): github.com

[*] Target: github.com
[*] Wordlist: subdomains-top1million-5000.txt
[*] Thread count: 50
[*] Starting scan...

[*] 5000 subdomains loaded

[+] Found: http://www.github.com (Status: 200)
[+] Found: http://api.github.com (Status: 200)
[+] Found: http://blog.github.com (Status: 200)
[+] Found: http://gist.github.com (Status: 200)

==================================================
[*] Scan completed!
[*] Total 27 subdomains found!
==================================================

⚠️ Disclaimer

For educational and authorized testing purposes only.

• Only scan domains you own or have explicit permission to test
• Respect rate limits and terms of service
• Aggressive scanning may be considered hostile by some organizations
• The author is not responsible for misuse of this tool

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📝 License

This project is open source and available under the MIT License.

🙏 Acknowledgments

• SecLists - For the comprehensive wordlists
• Requests - For the excellent HTTP library

📧 Contact

Questions or suggestions? Open an issue or reach out!

---

⭐ If you find this tool useful, please consider giving it a star!