subcat 1.3.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- subcat-1.3.1/PKG-INFO +278 -0
- subcat-1.3.1/README.md +262 -0
- subcat-1.3.1/pyproject.toml +3 -0
- subcat-1.3.1/setup.cfg +36 -0
- subcat-1.3.1/setup.py +2 -0
- subcat-1.3.1/subcat/__init__.py +5 -0
- subcat-1.3.1/subcat/config.py +36 -0
- subcat-1.3.1/subcat/detector.py +213 -0
- subcat-1.3.1/subcat/fingerprints.json +80611 -0
- subcat-1.3.1/subcat/logger.py +110 -0
- subcat-1.3.1/subcat/modules/alienvault.py +90 -0
- subcat-1.3.1/subcat/modules/anubis.py +36 -0
- subcat-1.3.1/subcat/modules/bevigil.py +40 -0
- subcat-1.3.1/subcat/modules/binaryedge.py +107 -0
- subcat-1.3.1/subcat/modules/censys.py +116 -0
- subcat-1.3.1/subcat/modules/certspotter.py +29 -0
- subcat-1.3.1/subcat/modules/chaos.py +40 -0
- subcat-1.3.1/subcat/modules/ctrsh.py +34 -0
- subcat-1.3.1/subcat/modules/digitalyama.py +48 -0
- subcat-1.3.1/subcat/modules/dnsarchive.py +44 -0
- subcat-1.3.1/subcat/modules/dnsdumpster.py +47 -0
- subcat-1.3.1/subcat/modules/hackertarget.py +72 -0
- subcat-1.3.1/subcat/modules/netlas.py +74 -0
- subcat-1.3.1/subcat/modules/securitytrails.py +107 -0
- subcat-1.3.1/subcat/modules/shodan.py +93 -0
- subcat-1.3.1/subcat/modules/threatcrowd.py +83 -0
- subcat-1.3.1/subcat/modules/urlscan.py +73 -0
- subcat-1.3.1/subcat/modules/virustotal.py +114 -0
- subcat-1.3.1/subcat/modules/wayback.py +45 -0
- subcat-1.3.1/subcat/navigator.py +207 -0
- subcat-1.3.1/subcat/subcat.py +618 -0
- subcat-1.3.1/subcat.egg-info/PKG-INFO +278 -0
- subcat-1.3.1/subcat.egg-info/SOURCES.txt +36 -0
- subcat-1.3.1/subcat.egg-info/dependency_links.txt +1 -0
- subcat-1.3.1/subcat.egg-info/entry_points.txt +2 -0
- subcat-1.3.1/subcat.egg-info/requires.txt +2 -0
- subcat-1.3.1/subcat.egg-info/top_level.txt +1 -0
subcat-1.3.1/PKG-INFO
ADDED
|
@@ -0,0 +1,278 @@
|
|
|
1
|
+
Metadata-Version: 2.2
|
|
2
|
+
Name: subcat
|
|
3
|
+
Version: 1.3.1
|
|
4
|
+
Summary: Lightning-fast passive subdomain discovery tool for security professionals and bug bounty hunters.
|
|
5
|
+
Home-page: https://github.com/duty1g/subcat
|
|
6
|
+
Author: duty1g
|
|
7
|
+
Author-email: sec@dzauth.com
|
|
8
|
+
License: MIT
|
|
9
|
+
Classifier: Programming Language :: Python :: 3
|
|
10
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
11
|
+
Classifier: Operating System :: OS Independent
|
|
12
|
+
Requires-Python: >=3.6
|
|
13
|
+
Description-Content-Type: text/markdown
|
|
14
|
+
Requires-Dist: requests>=2.25.0
|
|
15
|
+
Requires-Dist: PyYAML>=5.4.0
|
|
16
|
+
|
|
17
|
+
|
|
18
|
+
# SubCat v1.3.0
|
|
19
|
+
|
|
20
|
+

|
|
21
|
+

|
|
22
|
+

|
|
23
|
+
<a href="https://twitter.com/duty_1g"><img src="https://img.shields.io/twitter/follow/duty_1g.svg?logo=twitter"></a>
|
|
24
|
+
|
|
25
|
+
|
|
26
|
+
<p align="center"><img src="https://user-images.githubusercontent.com/3162883/168605639-8a2cb290-38d3-4edb-9587-584d17f4fac3.png#gh-dark-mode-only" width="60%"/>
|
|
27
|
+
<img src="https://user-images.githubusercontent.com/3162883/169028346-3151e07e-ea94-4911-8009-942a5f384c77.png#gh-light-mode-only" width="60%"/>
|
|
28
|
+
</p>
|
|
29
|
+
<h4 align="center">Fast subdomain enumeration tool.</h4>
|
|
30
|
+
|
|
31
|
+
<p align="center">
|
|
32
|
+
<a href="#features">Features</a> •
|
|
33
|
+
<a href="#Install">Install</a> •
|
|
34
|
+
<a href="#post-installation">Post Installation</a> •
|
|
35
|
+
<a href="#Usage">Usage</a> •
|
|
36
|
+
<a href="#running-subcat">Running SubCat</a>
|
|
37
|
+
<a href="#available-modules">Available Modules</a>
|
|
38
|
+
</p>
|
|
39
|
+
|
|
40
|
+
#
|
|
41
|
+
SubCat is a powerful subdomain discovery tool that passively aggregates data from a variety of online sources to identify valid subdomains for websites. Designed with a modular and efficient architecture, SubCat is ideal for penetration testers, bug bounty hunters, and security researchers.
|
|
42
|
+
|
|
43
|
+
Built to comply with licensing and usage restrictions of its passive sources, SubCat ensures minimal impact on target systems while delivering in-depth subdomain intelligence.
|
|
44
|
+
|
|
45
|
+
|
|
46
|
+
## Features
|
|
47
|
+
|
|
48
|
+
<img width="1000" alt="demo" src="https://github.com/user-attachments/assets/1de8c659-f35b-44ce-9aa8-c0437717591b">
|
|
49
|
+
|
|
50
|
+
- **Fast Enumeration:** Leverages a high-performance resolution and wildcard elimination module.
|
|
51
|
+
- **Curated Passive Sources:** Gathers subdomains from trusted online sources to maximize coverage.
|
|
52
|
+
- **Lightweight & Efficient:** Optimized for speed with minimal resource consumption.
|
|
53
|
+
- **STDIN/STDOUT Integration:** Seamlessly integrate with other tools and workflows.
|
|
54
|
+
- **IP Scope Filtering:** Filter results by IP addresses using a provided scope (CIDR or file-based).
|
|
55
|
+
- **Detailed Output:** Options to display HTTP status codes, page titles, IP addresses, and technology detection.
|
|
56
|
+
- **Reverse Lookup Mode:** Supports reverse lookup to load only modules that handle reverse enumeration (requires a valid IP scope).
|
|
57
|
+
- **Custom Module Selection:** Include or exclude specific modules via command-line flags.
|
|
58
|
+
- **Enhanced Multi-threading:** Uses 50 concurrent threads by default for rapid processing.
|
|
59
|
+
|
|
60
|
+
|
|
61
|
+
## Install
|
|
62
|
+
```
|
|
63
|
+
# Linux, Windows, MacOS
|
|
64
|
+
pip install subcat
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
## Post Installation
|
|
68
|
+
|
|
69
|
+
Before querying third-party services, configure your API keys in the `config.yaml` file.
|
|
70
|
+
|
|
71
|
+
By default, SubCat looks for the configuration file in your user's home directory under `~/.subcat/config.yaml`. You can also specify a custom config path using the `-c` or `--config` option.
|
|
72
|
+
|
|
73
|
+
> Not all modules require an API key, but the following sources do:
|
|
74
|
+
|
|
75
|
+
- **BinaryEdge**
|
|
76
|
+
- **Virustotal**
|
|
77
|
+
- **SecurityTrails**
|
|
78
|
+
- **Shodan**
|
|
79
|
+
- **Bevigil**
|
|
80
|
+
- **Chaos**
|
|
81
|
+
- **DNSDumpster**
|
|
82
|
+
- **Netlas**
|
|
83
|
+
- **DigitalYama**
|
|
84
|
+
- **Censys**
|
|
85
|
+
- **AlienVault**
|
|
86
|
+
- **CertSpotter**
|
|
87
|
+
- **URLScan** (for advanced usage)
|
|
88
|
+
|
|
89
|
+
|
|
90
|
+
An example provider config file
|
|
91
|
+
|
|
92
|
+
```yaml
|
|
93
|
+
|
|
94
|
+
binaryedge:
|
|
95
|
+
- e3a2f1c4-9d2b-47f3-a1e2-4b8d7f0a1c2e
|
|
96
|
+
virustotal:
|
|
97
|
+
- b1e2d3c4f5a6978877665544332211ffeeddccbbaa99887766554433221100ff
|
|
98
|
+
securitytrails:
|
|
99
|
+
- X7a9B2c4D6e8F0g1H3i5J7k9L1m3N5o7
|
|
100
|
+
- P8q6R4s2T0u8V6w4X2y0Z8a6B4c2D0e2
|
|
101
|
+
shodan:
|
|
102
|
+
- M3n4O5p6Q7r8S9t0U1v2W3x4Y5z6A7b8
|
|
103
|
+
bevigil:
|
|
104
|
+
- F1g2H3i4J5k6L7m8
|
|
105
|
+
chaos:
|
|
106
|
+
- d2c4b6a8-90ef-12ab-34cd-56ef78ab90cd
|
|
107
|
+
dnsdumpster:
|
|
108
|
+
- c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
|
|
109
|
+
- e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5
|
|
110
|
+
netlas:
|
|
111
|
+
- Z1x2C3v4B5n6M7a8S9d0F1g2H3j4K5l6
|
|
112
|
+
digitalyama:
|
|
113
|
+
- Q1w2E3r4T5y6U7i8O9p0
|
|
114
|
+
|
|
115
|
+
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
## Usage
|
|
119
|
+
|
|
120
|
+
```console
|
|
121
|
+
subcat -h
|
|
122
|
+
```
|
|
123
|
+
This will display help for the tool. Here are all the switches it supports.
|
|
124
|
+
|
|
125
|
+
```yaml
|
|
126
|
+
INPUT:
|
|
127
|
+
-d DOMAIN, --domain DOMAIN
|
|
128
|
+
Target domain to scan
|
|
129
|
+
-l LIST, --list LIST File containing list of domains
|
|
130
|
+
--scope SCOPE IP scope filter: provide either a file containing CIDR ranges or a single IP/CIDR string (e.g., '8.8.8.8' or
|
|
131
|
+
'8.8.4.0/24'). This filter is required when reverse lookup is enabled.
|
|
132
|
+
|
|
133
|
+
OUTPUT:
|
|
134
|
+
-o OUTPUT, --output OUTPUT
|
|
135
|
+
Output file
|
|
136
|
+
-title, --title Show page titles
|
|
137
|
+
-ip, --ip Resolve IP addresses
|
|
138
|
+
-sc, --status-code Show HTTP status codes
|
|
139
|
+
--up Show only domains that are up (exclude TIMEOUT)
|
|
140
|
+
-td, --tech Show detected technologies
|
|
141
|
+
-nc, --no-colors Disable colored output in console
|
|
142
|
+
|
|
143
|
+
FILTERS:
|
|
144
|
+
-mc MATCH_CODES, --match-codes MATCH_CODES
|
|
145
|
+
Comma separated list of HTTP status codes to filter (e.g., 200,404)
|
|
146
|
+
|
|
147
|
+
SOURCE:
|
|
148
|
+
-ls List available modules and exit
|
|
149
|
+
-s SOURCES, --sources SOURCES
|
|
150
|
+
Specific sources to use for discovery (comma-separated, e.g., crtsh,wayback)
|
|
151
|
+
-es EXCLUDE_SOURCES, --exclude-sources EXCLUDE_SOURCES
|
|
152
|
+
Sources to exclude from enumeration (comma-separated, e.g., alienvault,crtsh)
|
|
153
|
+
-r, --reverse Enable reverse lookup mode for enumeration (loads only modules supporting reverse lookup). Requires --scope
|
|
154
|
+
to be provided.
|
|
155
|
+
|
|
156
|
+
CONFIGURATION:
|
|
157
|
+
-t THREADS, --threads THREADS
|
|
158
|
+
Number of concurrent threads (default: 50)
|
|
159
|
+
-c CONFIG, --config CONFIG
|
|
160
|
+
Path to YAML config file (default: config.yaml)
|
|
161
|
+
|
|
162
|
+
DEBUG:
|
|
163
|
+
-v, --verbose Increase verbosity level (-v, -vv, -vvv)
|
|
164
|
+
-silent, --silent Suppress all output except results
|
|
165
|
+
-h, --help Show this help message and exit
|
|
166
|
+
```
|
|
167
|
+
|
|
168
|
+
## Running SubCat
|
|
169
|
+
Here are several examples to help you get started:
|
|
170
|
+
|
|
171
|
+
**Scan a Single Domain:**
|
|
172
|
+
```console
|
|
173
|
+
subcat -d hackerone.com --sc --title --tech --up
|
|
174
|
+
|
|
175
|
+
|
|
176
|
+
; ;
|
|
177
|
+
ρββΚ ;ββΝ
|
|
178
|
+
έΆχββββββββββββββββββΒ
|
|
179
|
+
;ΣΆχΜ΅΅ΫΝββββββββ Ϋ΅ΫβββΝ
|
|
180
|
+
όΆΆχβ Ά ββββ΅ Ά΅ βββββ
|
|
181
|
+
χΆΆΆφβΒ; Ϋ΅;έββββΒ; Ϋ΅ ρββββββ
|
|
182
|
+
ΆΆΆΆδβββββββββ;χββββββμβββββββ
|
|
183
|
+
ΪχχχχΧβββββββββββββββββββθθθθΚ
|
|
184
|
+
·ϊβθβζ Ϊθθβββββββββββββββμ ;όβΫ΅
|
|
185
|
+
·΅ ΅ΫΫΫΆΆθβββββββββθθΫ΅ ΅Ϋ΅
|
|
186
|
+
;ΣΆθββββΒΝρρρμ
|
|
187
|
+
;ΣΆΆβββββββββββμ
|
|
188
|
+
▄∞∞∞∞∞▄, ╒∞∞▄ ∞∞▄ ▄∞∞∞∞∞∞▄ ,▄∞∞∞∞▄ ▄∞∞4▄ ╒∞∞∞∞∞∞∞▄,
|
|
189
|
+
▐▄ ═▄▄▄ ▐█▐ ,▀ j' █▌█ ▄▄▄ ▀█▌█▀ ╓▄▄ ▀▄ ¡█ , ▐█ ▐▄▄▄ ▄▄██
|
|
190
|
+
▐▄ `'""▀██▐ █▌ j █▌█ `"" ▄█▌█ ▐█▀`▀▄██' M $██ █, `█ ▐█```
|
|
191
|
+
j▀▀███▌ ▐█▐ ▀▌▄█ ▀▀█ ▐███ █▌▄ ▀█▄▄▀ ▐█M▀. ▀█▄.▀ J▀
|
|
192
|
+
╚▄,,¬¬⌐▄█▌ ▀▄,,, ▄██ █,,,,,▓██▌ ▀▄,,,,▄█╩j▌,██▀▀▀▀▌,█▌`█,▐█
|
|
193
|
+
▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ""▀▀▀▀▀▀ ▀▀▀""` ▀▀▀ ▀▀▀ ▀▀▀
|
|
194
|
+
΅qΆΆΆΆβββββββββββββββββββββΡ΅
|
|
195
|
+
ΫθΆΆΆββββββββββββββββΡ΅
|
|
196
|
+
΅ΫΫΫ΅ΝNNΝΫΫΫΐ΅Ϋ
|
|
197
|
+
v{1.3.0#dev}@duty1g
|
|
198
|
+
|
|
199
|
+
[07:43:51][INF]: Starting enumeration for hackerone.com
|
|
200
|
+
[07:43:51][INF]: Loaded 19 modules
|
|
201
|
+
https://mta-sts.managed.hackerone.com [Page not found · GitHub] [Fastly,GitHub Pages]
|
|
202
|
+
https://www.hackerone.com [HackerOne | #1 Trusted Securit] [Google Tag Manager,Drupal,HSTS,Cloudflare,Pantheon,PHP,Fastly,MariaDB,Nginx]
|
|
203
|
+
https://gslink.hackerone.com [404 Not Found] [Nginx,Amazon CloudFront,Amazon Web Services]
|
|
204
|
+
https://mta-sts.hackerone.com [Page not found · GitHub] [GitHub Pages,Fastly]
|
|
205
|
+
https://api.hackerone.com [HackerOne API] [Algolia,HSTS,Cloudflare]
|
|
206
|
+
http://resources.hackerone.com [Sorry, no Folders found.] [Amazon Web Services]
|
|
207
|
+
https://hackerone.com [HackerOne | #1 Trusted Securit] [Cloudflare,Drupal,Google Tag Manager,HSTS,Pantheon,PHP,Fastly,MariaDB,Nginx]
|
|
208
|
+
https://mta-sts.forwarding.hackerone.com [Page not found · GitHub] [Fastly,GitHub Pages]
|
|
209
|
+
https://docs.hackerone.com [HackerOne Help Center] [Cloudflare,HSTS]
|
|
210
|
+
https://support.hackerone.com [Sign into : HackerOne Support ] [HSTS,Envoy,Cloudflare,HTTP/3]
|
|
211
|
+
[07:44:00][INF]: Completed with 23 subdomains for hackerone.com in 9 seconds 58 milliseconds
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
**Pipe Domains from a File with IP Resolution and HTTP Status Codes:**
|
|
215
|
+
```console
|
|
216
|
+
cat domains.txt | subcat -ip -sc
|
|
217
|
+
```
|
|
218
|
+
|
|
219
|
+
**Run with Reverse Lookup Mode (Requires IP Scope):**
|
|
220
|
+
```console
|
|
221
|
+
subcat -d example.com --scope 8.8.8.0/24 -r
|
|
222
|
+
```
|
|
223
|
+
|
|
224
|
+
**Scan a Domain and Save the Output to a File (Verbose Mode):**
|
|
225
|
+
```console
|
|
226
|
+
subcat -d hackerone.com -o output.txt -v
|
|
227
|
+
```
|
|
228
|
+
|
|
229
|
+
**Integrate with HTTPx for Further Processing or any other tool:**
|
|
230
|
+
```console
|
|
231
|
+
echo hackerone.com | subcat -silent -td -title | httpx -silent
|
|
232
|
+
```
|
|
233
|
+
|
|
234
|
+
**Scan Multiple Domains from a List:**
|
|
235
|
+
```console
|
|
236
|
+
subcat -l domains.txt
|
|
237
|
+
```
|
|
238
|
+
|
|
239
|
+
**Custom Module Selection:**
|
|
240
|
+
```console
|
|
241
|
+
subcat -d example.com -s dnsdumpster,virustotal,urlscan -es digitalyama,anubis
|
|
242
|
+
```
|
|
243
|
+
|
|
244
|
+
|
|
245
|
+
## Available Modules
|
|
246
|
+
|
|
247
|
+
SubCat currently supports the following modules for passive subdomain discovery:
|
|
248
|
+
|
|
249
|
+
- dnsdumpster
|
|
250
|
+
- digitalyama
|
|
251
|
+
- virustotal
|
|
252
|
+
- binaryedge
|
|
253
|
+
- chaos
|
|
254
|
+
- bevigil
|
|
255
|
+
- dnsarchive
|
|
256
|
+
- netlas
|
|
257
|
+
- wayback
|
|
258
|
+
- shodan
|
|
259
|
+
- securitytrails
|
|
260
|
+
- urlscan
|
|
261
|
+
- ctrsh
|
|
262
|
+
- threatcrowd
|
|
263
|
+
- anubis
|
|
264
|
+
- censys
|
|
265
|
+
- alienvault
|
|
266
|
+
- hackertarget
|
|
267
|
+
- certspotter
|
|
268
|
+
|
|
269
|
+
SubCat's modular architecture is designed for flexibility and ease of extension.
|
|
270
|
+
|
|
271
|
+
If you have an idea for a new module or want to contribute improvements, feel free to submit a pull request. Your contributions help make SubCat even better!
|
|
272
|
+
|
|
273
|
+
|
|
274
|
+
### License
|
|
275
|
+
|
|
276
|
+
SubCat is made with 🖤 by duty1g
|
|
277
|
+
|
|
278
|
+
<a href="https://www.buymeacoffee.com/duty1g" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
|
subcat-1.3.1/README.md
ADDED
|
@@ -0,0 +1,262 @@
|
|
|
1
|
+
|
|
2
|
+
# SubCat v1.3.0
|
|
3
|
+
|
|
4
|
+

|
|
5
|
+

|
|
6
|
+

|
|
7
|
+
<a href="https://twitter.com/duty_1g"><img src="https://img.shields.io/twitter/follow/duty_1g.svg?logo=twitter"></a>
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
<p align="center"><img src="https://user-images.githubusercontent.com/3162883/168605639-8a2cb290-38d3-4edb-9587-584d17f4fac3.png#gh-dark-mode-only" width="60%"/>
|
|
11
|
+
<img src="https://user-images.githubusercontent.com/3162883/169028346-3151e07e-ea94-4911-8009-942a5f384c77.png#gh-light-mode-only" width="60%"/>
|
|
12
|
+
</p>
|
|
13
|
+
<h4 align="center">Fast subdomain enumeration tool.</h4>
|
|
14
|
+
|
|
15
|
+
<p align="center">
|
|
16
|
+
<a href="#features">Features</a> •
|
|
17
|
+
<a href="#Install">Install</a> •
|
|
18
|
+
<a href="#post-installation">Post Installation</a> •
|
|
19
|
+
<a href="#Usage">Usage</a> •
|
|
20
|
+
<a href="#running-subcat">Running SubCat</a>
|
|
21
|
+
<a href="#available-modules">Available Modules</a>
|
|
22
|
+
</p>
|
|
23
|
+
|
|
24
|
+
#
|
|
25
|
+
SubCat is a powerful subdomain discovery tool that passively aggregates data from a variety of online sources to identify valid subdomains for websites. Designed with a modular and efficient architecture, SubCat is ideal for penetration testers, bug bounty hunters, and security researchers.
|
|
26
|
+
|
|
27
|
+
Built to comply with licensing and usage restrictions of its passive sources, SubCat ensures minimal impact on target systems while delivering in-depth subdomain intelligence.
|
|
28
|
+
|
|
29
|
+
|
|
30
|
+
## Features
|
|
31
|
+
|
|
32
|
+
<img width="1000" alt="demo" src="https://github.com/user-attachments/assets/1de8c659-f35b-44ce-9aa8-c0437717591b">
|
|
33
|
+
|
|
34
|
+
- **Fast Enumeration:** Leverages a high-performance resolution and wildcard elimination module.
|
|
35
|
+
- **Curated Passive Sources:** Gathers subdomains from trusted online sources to maximize coverage.
|
|
36
|
+
- **Lightweight & Efficient:** Optimized for speed with minimal resource consumption.
|
|
37
|
+
- **STDIN/STDOUT Integration:** Seamlessly integrate with other tools and workflows.
|
|
38
|
+
- **IP Scope Filtering:** Filter results by IP addresses using a provided scope (CIDR or file-based).
|
|
39
|
+
- **Detailed Output:** Options to display HTTP status codes, page titles, IP addresses, and technology detection.
|
|
40
|
+
- **Reverse Lookup Mode:** Supports reverse lookup to load only modules that handle reverse enumeration (requires a valid IP scope).
|
|
41
|
+
- **Custom Module Selection:** Include or exclude specific modules via command-line flags.
|
|
42
|
+
- **Enhanced Multi-threading:** Uses 50 concurrent threads by default for rapid processing.
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
## Install
|
|
46
|
+
```
|
|
47
|
+
# Linux, Windows, MacOS
|
|
48
|
+
pip install subcat
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
## Post Installation
|
|
52
|
+
|
|
53
|
+
Before querying third-party services, configure your API keys in the `config.yaml` file.
|
|
54
|
+
|
|
55
|
+
By default, SubCat looks for the configuration file in your user's home directory under `~/.subcat/config.yaml`. You can also specify a custom config path using the `-c` or `--config` option.
|
|
56
|
+
|
|
57
|
+
> Not all modules require an API key, but the following sources do:
|
|
58
|
+
|
|
59
|
+
- **BinaryEdge**
|
|
60
|
+
- **Virustotal**
|
|
61
|
+
- **SecurityTrails**
|
|
62
|
+
- **Shodan**
|
|
63
|
+
- **Bevigil**
|
|
64
|
+
- **Chaos**
|
|
65
|
+
- **DNSDumpster**
|
|
66
|
+
- **Netlas**
|
|
67
|
+
- **DigitalYama**
|
|
68
|
+
- **Censys**
|
|
69
|
+
- **AlienVault**
|
|
70
|
+
- **CertSpotter**
|
|
71
|
+
- **URLScan** (for advanced usage)
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
An example provider config file
|
|
75
|
+
|
|
76
|
+
```yaml
|
|
77
|
+
|
|
78
|
+
binaryedge:
|
|
79
|
+
- e3a2f1c4-9d2b-47f3-a1e2-4b8d7f0a1c2e
|
|
80
|
+
virustotal:
|
|
81
|
+
- b1e2d3c4f5a6978877665544332211ffeeddccbbaa99887766554433221100ff
|
|
82
|
+
securitytrails:
|
|
83
|
+
- X7a9B2c4D6e8F0g1H3i5J7k9L1m3N5o7
|
|
84
|
+
- P8q6R4s2T0u8V6w4X2y0Z8a6B4c2D0e2
|
|
85
|
+
shodan:
|
|
86
|
+
- M3n4O5p6Q7r8S9t0U1v2W3x4Y5z6A7b8
|
|
87
|
+
bevigil:
|
|
88
|
+
- F1g2H3i4J5k6L7m8
|
|
89
|
+
chaos:
|
|
90
|
+
- d2c4b6a8-90ef-12ab-34cd-56ef78ab90cd
|
|
91
|
+
dnsdumpster:
|
|
92
|
+
- c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
|
|
93
|
+
- e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5
|
|
94
|
+
netlas:
|
|
95
|
+
- Z1x2C3v4B5n6M7a8S9d0F1g2H3j4K5l6
|
|
96
|
+
digitalyama:
|
|
97
|
+
- Q1w2E3r4T5y6U7i8O9p0
|
|
98
|
+
|
|
99
|
+
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
## Usage
|
|
103
|
+
|
|
104
|
+
```console
|
|
105
|
+
subcat -h
|
|
106
|
+
```
|
|
107
|
+
This will display help for the tool. Here are all the switches it supports.
|
|
108
|
+
|
|
109
|
+
```yaml
|
|
110
|
+
INPUT:
|
|
111
|
+
-d DOMAIN, --domain DOMAIN
|
|
112
|
+
Target domain to scan
|
|
113
|
+
-l LIST, --list LIST File containing list of domains
|
|
114
|
+
--scope SCOPE IP scope filter: provide either a file containing CIDR ranges or a single IP/CIDR string (e.g., '8.8.8.8' or
|
|
115
|
+
'8.8.4.0/24'). This filter is required when reverse lookup is enabled.
|
|
116
|
+
|
|
117
|
+
OUTPUT:
|
|
118
|
+
-o OUTPUT, --output OUTPUT
|
|
119
|
+
Output file
|
|
120
|
+
-title, --title Show page titles
|
|
121
|
+
-ip, --ip Resolve IP addresses
|
|
122
|
+
-sc, --status-code Show HTTP status codes
|
|
123
|
+
--up Show only domains that are up (exclude TIMEOUT)
|
|
124
|
+
-td, --tech Show detected technologies
|
|
125
|
+
-nc, --no-colors Disable colored output in console
|
|
126
|
+
|
|
127
|
+
FILTERS:
|
|
128
|
+
-mc MATCH_CODES, --match-codes MATCH_CODES
|
|
129
|
+
Comma separated list of HTTP status codes to filter (e.g., 200,404)
|
|
130
|
+
|
|
131
|
+
SOURCE:
|
|
132
|
+
-ls List available modules and exit
|
|
133
|
+
-s SOURCES, --sources SOURCES
|
|
134
|
+
Specific sources to use for discovery (comma-separated, e.g., crtsh,wayback)
|
|
135
|
+
-es EXCLUDE_SOURCES, --exclude-sources EXCLUDE_SOURCES
|
|
136
|
+
Sources to exclude from enumeration (comma-separated, e.g., alienvault,crtsh)
|
|
137
|
+
-r, --reverse Enable reverse lookup mode for enumeration (loads only modules supporting reverse lookup). Requires --scope
|
|
138
|
+
to be provided.
|
|
139
|
+
|
|
140
|
+
CONFIGURATION:
|
|
141
|
+
-t THREADS, --threads THREADS
|
|
142
|
+
Number of concurrent threads (default: 50)
|
|
143
|
+
-c CONFIG, --config CONFIG
|
|
144
|
+
Path to YAML config file (default: config.yaml)
|
|
145
|
+
|
|
146
|
+
DEBUG:
|
|
147
|
+
-v, --verbose Increase verbosity level (-v, -vv, -vvv)
|
|
148
|
+
-silent, --silent Suppress all output except results
|
|
149
|
+
-h, --help Show this help message and exit
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
## Running SubCat
|
|
153
|
+
Here are several examples to help you get started:
|
|
154
|
+
|
|
155
|
+
**Scan a Single Domain:**
|
|
156
|
+
```console
|
|
157
|
+
subcat -d hackerone.com --sc --title --tech --up
|
|
158
|
+
|
|
159
|
+
|
|
160
|
+
; ;
|
|
161
|
+
ρββΚ ;ββΝ
|
|
162
|
+
έΆχββββββββββββββββββΒ
|
|
163
|
+
;ΣΆχΜ΅΅ΫΝββββββββ Ϋ΅ΫβββΝ
|
|
164
|
+
όΆΆχβ Ά ββββ΅ Ά΅ βββββ
|
|
165
|
+
χΆΆΆφβΒ; Ϋ΅;έββββΒ; Ϋ΅ ρββββββ
|
|
166
|
+
ΆΆΆΆδβββββββββ;χββββββμβββββββ
|
|
167
|
+
ΪχχχχΧβββββββββββββββββββθθθθΚ
|
|
168
|
+
·ϊβθβζ Ϊθθβββββββββββββββμ ;όβΫ΅
|
|
169
|
+
·΅ ΅ΫΫΫΆΆθβββββββββθθΫ΅ ΅Ϋ΅
|
|
170
|
+
;ΣΆθββββΒΝρρρμ
|
|
171
|
+
;ΣΆΆβββββββββββμ
|
|
172
|
+
▄∞∞∞∞∞▄, ╒∞∞▄ ∞∞▄ ▄∞∞∞∞∞∞▄ ,▄∞∞∞∞▄ ▄∞∞4▄ ╒∞∞∞∞∞∞∞▄,
|
|
173
|
+
▐▄ ═▄▄▄ ▐█▐ ,▀ j' █▌█ ▄▄▄ ▀█▌█▀ ╓▄▄ ▀▄ ¡█ , ▐█ ▐▄▄▄ ▄▄██
|
|
174
|
+
▐▄ `'""▀██▐ █▌ j █▌█ `"" ▄█▌█ ▐█▀`▀▄██' M $██ █, `█ ▐█```
|
|
175
|
+
j▀▀███▌ ▐█▐ ▀▌▄█ ▀▀█ ▐███ █▌▄ ▀█▄▄▀ ▐█M▀. ▀█▄.▀ J▀
|
|
176
|
+
╚▄,,¬¬⌐▄█▌ ▀▄,,, ▄██ █,,,,,▓██▌ ▀▄,,,,▄█╩j▌,██▀▀▀▀▌,█▌`█,▐█
|
|
177
|
+
▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ""▀▀▀▀▀▀ ▀▀▀""` ▀▀▀ ▀▀▀ ▀▀▀
|
|
178
|
+
΅qΆΆΆΆβββββββββββββββββββββΡ΅
|
|
179
|
+
ΫθΆΆΆββββββββββββββββΡ΅
|
|
180
|
+
΅ΫΫΫ΅ΝNNΝΫΫΫΐ΅Ϋ
|
|
181
|
+
v{1.3.0#dev}@duty1g
|
|
182
|
+
|
|
183
|
+
[07:43:51][INF]: Starting enumeration for hackerone.com
|
|
184
|
+
[07:43:51][INF]: Loaded 19 modules
|
|
185
|
+
https://mta-sts.managed.hackerone.com [Page not found · GitHub] [Fastly,GitHub Pages]
|
|
186
|
+
https://www.hackerone.com [HackerOne | #1 Trusted Securit] [Google Tag Manager,Drupal,HSTS,Cloudflare,Pantheon,PHP,Fastly,MariaDB,Nginx]
|
|
187
|
+
https://gslink.hackerone.com [404 Not Found] [Nginx,Amazon CloudFront,Amazon Web Services]
|
|
188
|
+
https://mta-sts.hackerone.com [Page not found · GitHub] [GitHub Pages,Fastly]
|
|
189
|
+
https://api.hackerone.com [HackerOne API] [Algolia,HSTS,Cloudflare]
|
|
190
|
+
http://resources.hackerone.com [Sorry, no Folders found.] [Amazon Web Services]
|
|
191
|
+
https://hackerone.com [HackerOne | #1 Trusted Securit] [Cloudflare,Drupal,Google Tag Manager,HSTS,Pantheon,PHP,Fastly,MariaDB,Nginx]
|
|
192
|
+
https://mta-sts.forwarding.hackerone.com [Page not found · GitHub] [Fastly,GitHub Pages]
|
|
193
|
+
https://docs.hackerone.com [HackerOne Help Center] [Cloudflare,HSTS]
|
|
194
|
+
https://support.hackerone.com [Sign into : HackerOne Support ] [HSTS,Envoy,Cloudflare,HTTP/3]
|
|
195
|
+
[07:44:00][INF]: Completed with 23 subdomains for hackerone.com in 9 seconds 58 milliseconds
|
|
196
|
+
```
|
|
197
|
+
|
|
198
|
+
**Pipe Domains from a File with IP Resolution and HTTP Status Codes:**
|
|
199
|
+
```console
|
|
200
|
+
cat domains.txt | subcat -ip -sc
|
|
201
|
+
```
|
|
202
|
+
|
|
203
|
+
**Run with Reverse Lookup Mode (Requires IP Scope):**
|
|
204
|
+
```console
|
|
205
|
+
subcat -d example.com --scope 8.8.8.0/24 -r
|
|
206
|
+
```
|
|
207
|
+
|
|
208
|
+
**Scan a Domain and Save the Output to a File (Verbose Mode):**
|
|
209
|
+
```console
|
|
210
|
+
subcat -d hackerone.com -o output.txt -v
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
**Integrate with HTTPx for Further Processing or any other tool:**
|
|
214
|
+
```console
|
|
215
|
+
echo hackerone.com | subcat -silent -td -title | httpx -silent
|
|
216
|
+
```
|
|
217
|
+
|
|
218
|
+
**Scan Multiple Domains from a List:**
|
|
219
|
+
```console
|
|
220
|
+
subcat -l domains.txt
|
|
221
|
+
```
|
|
222
|
+
|
|
223
|
+
**Custom Module Selection:**
|
|
224
|
+
```console
|
|
225
|
+
subcat -d example.com -s dnsdumpster,virustotal,urlscan -es digitalyama,anubis
|
|
226
|
+
```
|
|
227
|
+
|
|
228
|
+
|
|
229
|
+
## Available Modules
|
|
230
|
+
|
|
231
|
+
SubCat currently supports the following modules for passive subdomain discovery:
|
|
232
|
+
|
|
233
|
+
- dnsdumpster
|
|
234
|
+
- digitalyama
|
|
235
|
+
- virustotal
|
|
236
|
+
- binaryedge
|
|
237
|
+
- chaos
|
|
238
|
+
- bevigil
|
|
239
|
+
- dnsarchive
|
|
240
|
+
- netlas
|
|
241
|
+
- wayback
|
|
242
|
+
- shodan
|
|
243
|
+
- securitytrails
|
|
244
|
+
- urlscan
|
|
245
|
+
- ctrsh
|
|
246
|
+
- threatcrowd
|
|
247
|
+
- anubis
|
|
248
|
+
- censys
|
|
249
|
+
- alienvault
|
|
250
|
+
- hackertarget
|
|
251
|
+
- certspotter
|
|
252
|
+
|
|
253
|
+
SubCat's modular architecture is designed for flexibility and ease of extension.
|
|
254
|
+
|
|
255
|
+
If you have an idea for a new module or want to contribute improvements, feel free to submit a pull request. Your contributions help make SubCat even better!
|
|
256
|
+
|
|
257
|
+
|
|
258
|
+
### License
|
|
259
|
+
|
|
260
|
+
SubCat is made with 🖤 by duty1g
|
|
261
|
+
|
|
262
|
+
<a href="https://www.buymeacoffee.com/duty1g" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
|
subcat-1.3.1/setup.cfg
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
[metadata]
|
|
2
|
+
name = subcat
|
|
3
|
+
version = 1.3.1
|
|
4
|
+
description = Lightning-fast passive subdomain discovery tool for security professionals and bug bounty hunters.
|
|
5
|
+
long_description = file: README.md
|
|
6
|
+
long_description_content_type = text/markdown
|
|
7
|
+
author = duty1g
|
|
8
|
+
author_email = sec@dzauth.com
|
|
9
|
+
url = https://github.com/duty1g/subcat
|
|
10
|
+
license = MIT
|
|
11
|
+
classifiers =
|
|
12
|
+
Programming Language :: Python :: 3
|
|
13
|
+
License :: OSI Approved :: MIT License
|
|
14
|
+
Operating System :: OS Independent
|
|
15
|
+
|
|
16
|
+
[options]
|
|
17
|
+
packages = find:
|
|
18
|
+
python_requires = >=3.6
|
|
19
|
+
install_requires =
|
|
20
|
+
requests>=2.25.0
|
|
21
|
+
PyYAML>=5.4.0
|
|
22
|
+
include_package_data = True
|
|
23
|
+
|
|
24
|
+
[options.package_data]
|
|
25
|
+
subcat =
|
|
26
|
+
fingerprints.json
|
|
27
|
+
modules/*.py
|
|
28
|
+
|
|
29
|
+
[options.entry_points]
|
|
30
|
+
console_scripts =
|
|
31
|
+
subcat = subcat.subcat:main
|
|
32
|
+
|
|
33
|
+
[egg_info]
|
|
34
|
+
tag_build =
|
|
35
|
+
tag_date = 0
|
|
36
|
+
|
subcat-1.3.1/setup.py
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
import yaml
|
|
2
|
+
import os
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
class Config:
|
|
6
|
+
def __init__(self, logger=None, config: str = 'config.yaml'):
|
|
7
|
+
self.logger = logger
|
|
8
|
+
# Check if config is an absolute path; if not, use current file's directory.
|
|
9
|
+
if not os.path.isabs(config):
|
|
10
|
+
dir_path = os.path.dirname(os.path.realpath(__file__))
|
|
11
|
+
self.config = os.path.join(dir_path, config)
|
|
12
|
+
else:
|
|
13
|
+
self.config = config
|
|
14
|
+
|
|
15
|
+
# Check if the file exists
|
|
16
|
+
if not os.path.exists(self.config):
|
|
17
|
+
if self.logger:
|
|
18
|
+
self.logger.error(f"Config file not found: {self.config}")
|
|
19
|
+
else:
|
|
20
|
+
print(f"Config file not found: {self.config}")
|
|
21
|
+
self.config = None
|
|
22
|
+
|
|
23
|
+
def read(self, module: str):
|
|
24
|
+
if not self.config:
|
|
25
|
+
return False
|
|
26
|
+
try:
|
|
27
|
+
with open(self.config, 'r') as f:
|
|
28
|
+
data = yaml.safe_load(f)
|
|
29
|
+
# Return the module data if present, else False
|
|
30
|
+
return data.get(module, False)
|
|
31
|
+
except Exception as e:
|
|
32
|
+
if self.logger:
|
|
33
|
+
self.logger.error(f"Failed to read config file: {e}")
|
|
34
|
+
else:
|
|
35
|
+
print(f"Failed to read config file: {e}")
|
|
36
|
+
return False
|