subcat 1.3.1__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. subcat-1.3.1/PKG-INFO +278 -0
  2. subcat-1.3.1/README.md +262 -0
  3. subcat-1.3.1/pyproject.toml +3 -0
  4. subcat-1.3.1/setup.cfg +36 -0
  5. subcat-1.3.1/setup.py +2 -0
  6. subcat-1.3.1/subcat/__init__.py +5 -0
  7. subcat-1.3.1/subcat/config.py +36 -0
  8. subcat-1.3.1/subcat/detector.py +213 -0
  9. subcat-1.3.1/subcat/fingerprints.json +80611 -0
  10. subcat-1.3.1/subcat/logger.py +110 -0
  11. subcat-1.3.1/subcat/modules/alienvault.py +90 -0
  12. subcat-1.3.1/subcat/modules/anubis.py +36 -0
  13. subcat-1.3.1/subcat/modules/bevigil.py +40 -0
  14. subcat-1.3.1/subcat/modules/binaryedge.py +107 -0
  15. subcat-1.3.1/subcat/modules/censys.py +116 -0
  16. subcat-1.3.1/subcat/modules/certspotter.py +29 -0
  17. subcat-1.3.1/subcat/modules/chaos.py +40 -0
  18. subcat-1.3.1/subcat/modules/ctrsh.py +34 -0
  19. subcat-1.3.1/subcat/modules/digitalyama.py +48 -0
  20. subcat-1.3.1/subcat/modules/dnsarchive.py +44 -0
  21. subcat-1.3.1/subcat/modules/dnsdumpster.py +47 -0
  22. subcat-1.3.1/subcat/modules/hackertarget.py +72 -0
  23. subcat-1.3.1/subcat/modules/netlas.py +74 -0
  24. subcat-1.3.1/subcat/modules/securitytrails.py +107 -0
  25. subcat-1.3.1/subcat/modules/shodan.py +93 -0
  26. subcat-1.3.1/subcat/modules/threatcrowd.py +83 -0
  27. subcat-1.3.1/subcat/modules/urlscan.py +73 -0
  28. subcat-1.3.1/subcat/modules/virustotal.py +114 -0
  29. subcat-1.3.1/subcat/modules/wayback.py +45 -0
  30. subcat-1.3.1/subcat/navigator.py +207 -0
  31. subcat-1.3.1/subcat/subcat.py +618 -0
  32. subcat-1.3.1/subcat.egg-info/PKG-INFO +278 -0
  33. subcat-1.3.1/subcat.egg-info/SOURCES.txt +36 -0
  34. subcat-1.3.1/subcat.egg-info/dependency_links.txt +1 -0
  35. subcat-1.3.1/subcat.egg-info/entry_points.txt +2 -0
  36. subcat-1.3.1/subcat.egg-info/requires.txt +2 -0
  37. subcat-1.3.1/subcat.egg-info/top_level.txt +1 -0
subcat-1.3.1/PKG-INFO ADDED
@@ -0,0 +1,278 @@
1
+ Metadata-Version: 2.2
2
+ Name: subcat
3
+ Version: 1.3.1
4
+ Summary: Lightning-fast passive subdomain discovery tool for security professionals and bug bounty hunters.
5
+ Home-page: https://github.com/duty1g/subcat
6
+ Author: duty1g
7
+ Author-email: sec@dzauth.com
8
+ License: MIT
9
+ Classifier: Programming Language :: Python :: 3
10
+ Classifier: License :: OSI Approved :: MIT License
11
+ Classifier: Operating System :: OS Independent
12
+ Requires-Python: >=3.6
13
+ Description-Content-Type: text/markdown
14
+ Requires-Dist: requests>=2.25.0
15
+ Requires-Dist: PyYAML>=5.4.0
16
+
17
+
18
+ # SubCat v1.3.0
19
+
20
+ ![alt text](https://img.shields.io/github/stars/duty1g/subcat "")
21
+ ![alt text](https://img.shields.io/github/languages/top/duty1g/subcat "")
22
+ ![alt text](https://img.shields.io/github/license/duty1g/subcat "")
23
+ <a href="https://twitter.com/duty_1g"><img src="https://img.shields.io/twitter/follow/duty_1g.svg?logo=twitter"></a>
24
+
25
+
26
+ <p align="center"><img src="https://user-images.githubusercontent.com/3162883/168605639-8a2cb290-38d3-4edb-9587-584d17f4fac3.png#gh-dark-mode-only" width="60%"/>
27
+ <img src="https://user-images.githubusercontent.com/3162883/169028346-3151e07e-ea94-4911-8009-942a5f384c77.png#gh-light-mode-only" width="60%"/>
28
+ </p>
29
+ <h4 align="center">Fast subdomain enumeration tool.</h4>
30
+
31
+ <p align="center">
32
+ <a href="#features">Features</a> •
33
+ <a href="#Install">Install</a> •
34
+ <a href="#post-installation">Post Installation</a> •
35
+ <a href="#Usage">Usage</a> •
36
+ <a href="#running-subcat">Running SubCat</a>
37
+ <a href="#available-modules">Available Modules</a>
38
+ </p>
39
+
40
+ #
41
+ SubCat is a powerful subdomain discovery tool that passively aggregates data from a variety of online sources to identify valid subdomains for websites. Designed with a modular and efficient architecture, SubCat is ideal for penetration testers, bug bounty hunters, and security researchers.
42
+
43
+ Built to comply with licensing and usage restrictions of its passive sources, SubCat ensures minimal impact on target systems while delivering in-depth subdomain intelligence.
44
+
45
+
46
+ ## Features
47
+
48
+ <img width="1000" alt="demo" src="https://github.com/user-attachments/assets/1de8c659-f35b-44ce-9aa8-c0437717591b">
49
+
50
+ - **Fast Enumeration:** Leverages a high-performance resolution and wildcard elimination module.
51
+ - **Curated Passive Sources:** Gathers subdomains from trusted online sources to maximize coverage.
52
+ - **Lightweight & Efficient:** Optimized for speed with minimal resource consumption.
53
+ - **STDIN/STDOUT Integration:** Seamlessly integrate with other tools and workflows.
54
+ - **IP Scope Filtering:** Filter results by IP addresses using a provided scope (CIDR or file-based).
55
+ - **Detailed Output:** Options to display HTTP status codes, page titles, IP addresses, and technology detection.
56
+ - **Reverse Lookup Mode:** Supports reverse lookup to load only modules that handle reverse enumeration (requires a valid IP scope).
57
+ - **Custom Module Selection:** Include or exclude specific modules via command-line flags.
58
+ - **Enhanced Multi-threading:** Uses 50 concurrent threads by default for rapid processing.
59
+
60
+
61
+ ## Install
62
+ ```
63
+ # Linux, Windows, MacOS
64
+ pip install subcat
65
+ ```
66
+
67
+ ## Post Installation
68
+
69
+ Before querying third-party services, configure your API keys in the `config.yaml` file.
70
+
71
+ By default, SubCat looks for the configuration file in your user's home directory under `~/.subcat/config.yaml`. You can also specify a custom config path using the `-c` or `--config` option.
72
+
73
+ > Not all modules require an API key, but the following sources do:
74
+
75
+ - **BinaryEdge**
76
+ - **Virustotal**
77
+ - **SecurityTrails**
78
+ - **Shodan**
79
+ - **Bevigil**
80
+ - **Chaos**
81
+ - **DNSDumpster**
82
+ - **Netlas**
83
+ - **DigitalYama**
84
+ - **Censys**
85
+ - **AlienVault**
86
+ - **CertSpotter**
87
+ - **URLScan** (for advanced usage)
88
+
89
+
90
+ An example provider config file
91
+
92
+ ```yaml
93
+
94
+ binaryedge:
95
+ - e3a2f1c4-9d2b-47f3-a1e2-4b8d7f0a1c2e
96
+ virustotal:
97
+ - b1e2d3c4f5a6978877665544332211ffeeddccbbaa99887766554433221100ff
98
+ securitytrails:
99
+ - X7a9B2c4D6e8F0g1H3i5J7k9L1m3N5o7
100
+ - P8q6R4s2T0u8V6w4X2y0Z8a6B4c2D0e2
101
+ shodan:
102
+ - M3n4O5p6Q7r8S9t0U1v2W3x4Y5z6A7b8
103
+ bevigil:
104
+ - F1g2H3i4J5k6L7m8
105
+ chaos:
106
+ - d2c4b6a8-90ef-12ab-34cd-56ef78ab90cd
107
+ dnsdumpster:
108
+ - c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
109
+ - e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5
110
+ netlas:
111
+ - Z1x2C3v4B5n6M7a8S9d0F1g2H3j4K5l6
112
+ digitalyama:
113
+ - Q1w2E3r4T5y6U7i8O9p0
114
+
115
+
116
+ ```
117
+
118
+ ## Usage
119
+
120
+ ```console
121
+ subcat -h
122
+ ```
123
+ This will display help for the tool. Here are all the switches it supports.
124
+
125
+ ```yaml
126
+ INPUT:
127
+ -d DOMAIN, --domain DOMAIN
128
+ Target domain to scan
129
+ -l LIST, --list LIST File containing list of domains
130
+ --scope SCOPE IP scope filter: provide either a file containing CIDR ranges or a single IP/CIDR string (e.g., '8.8.8.8' or
131
+ '8.8.4.0/24'). This filter is required when reverse lookup is enabled.
132
+
133
+ OUTPUT:
134
+ -o OUTPUT, --output OUTPUT
135
+ Output file
136
+ -title, --title Show page titles
137
+ -ip, --ip Resolve IP addresses
138
+ -sc, --status-code Show HTTP status codes
139
+ --up Show only domains that are up (exclude TIMEOUT)
140
+ -td, --tech Show detected technologies
141
+ -nc, --no-colors Disable colored output in console
142
+
143
+ FILTERS:
144
+ -mc MATCH_CODES, --match-codes MATCH_CODES
145
+ Comma separated list of HTTP status codes to filter (e.g., 200,404)
146
+
147
+ SOURCE:
148
+ -ls List available modules and exit
149
+ -s SOURCES, --sources SOURCES
150
+ Specific sources to use for discovery (comma-separated, e.g., crtsh,wayback)
151
+ -es EXCLUDE_SOURCES, --exclude-sources EXCLUDE_SOURCES
152
+ Sources to exclude from enumeration (comma-separated, e.g., alienvault,crtsh)
153
+ -r, --reverse Enable reverse lookup mode for enumeration (loads only modules supporting reverse lookup). Requires --scope
154
+ to be provided.
155
+
156
+ CONFIGURATION:
157
+ -t THREADS, --threads THREADS
158
+ Number of concurrent threads (default: 50)
159
+ -c CONFIG, --config CONFIG
160
+ Path to YAML config file (default: config.yaml)
161
+
162
+ DEBUG:
163
+ -v, --verbose Increase verbosity level (-v, -vv, -vvv)
164
+ -silent, --silent Suppress all output except results
165
+ -h, --help Show this help message and exit
166
+ ```
167
+
168
+ ## Running SubCat
169
+ Here are several examples to help you get started:
170
+
171
+ **Scan a Single Domain:**
172
+ ```console
173
+ subcat -d hackerone.com --sc --title --tech --up
174
+
175
+
176
+ ; ;
177
+ ρββΚ ;ββΝ
178
+ έΆχββββββββββββββββββΒ
179
+ ;ΣΆχΜ΅΅ΫΝββββββββ Ϋ΅ΫβββΝ
180
+ όΆΆχβ Ά ββββ΅ Ά΅ βββββ
181
+ χΆΆΆφβΒ; Ϋ΅;έββββΒ; Ϋ΅ ρββββββ
182
+ ΆΆΆΆδβββββββββ;χββββββμβββββββ
183
+ ΪχχχχΧβββββββββββββββββββθθθθΚ
184
+ ·ϊβθβζ Ϊθθβββββββββββββββμ ;όβΫ΅
185
+ ·΅ ΅ΫΫΫΆΆθβββββββββθθΫ΅ ΅Ϋ΅
186
+ ;ΣΆθββββΒΝρρρμ
187
+ ;ΣΆΆβββββββββββμ
188
+ ▄∞∞∞∞∞▄, ╒∞∞▄ ∞∞▄ ▄∞∞∞∞∞∞▄ ,▄∞∞∞∞▄ ▄∞∞4▄ ╒∞∞∞∞∞∞∞▄,
189
+ ▐▄ ═▄▄▄ ▐█▐ ,▀ j' █▌█ ▄▄▄ ▀█▌█▀ ╓▄▄ ▀▄ ¡█ , ▐█ ▐▄▄▄ ▄▄██
190
+ ▐▄ `'""▀██▐ █▌ j █▌█ `"" ▄█▌█ ▐█▀`▀▄██' M $██ █, `█ ▐█```
191
+ j▀▀███▌ ▐█▐ ▀▌▄█ ▀▀█ ▐███ █▌▄ ▀█▄▄▀ ▐█M▀. ▀█▄.▀ J▀
192
+ ╚▄,,¬¬⌐▄█▌ ▀▄,,, ▄██ █,,,,,▓██▌ ▀▄,,,,▄█╩j▌,██▀▀▀▀▌,█▌`█,▐█
193
+ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ""▀▀▀▀▀▀ ▀▀▀""` ▀▀▀ ▀▀▀ ▀▀▀
194
+ ΅qΆΆΆΆβββββββββββββββββββββΡ΅
195
+ ΫθΆΆΆββββββββββββββββΡ΅
196
+ ΅ΫΫΫ΅ΝNNΝΫΫΫΐ΅Ϋ
197
+ v{1.3.0#dev}@duty1g
198
+
199
+ [07:43:51][INF]: Starting enumeration for hackerone.com
200
+ [07:43:51][INF]: Loaded 19 modules
201
+ https://mta-sts.managed.hackerone.com [Page not found &middot; GitHub] [Fastly,GitHub Pages]
202
+ https://www.hackerone.com [HackerOne | #1 Trusted Securit] [Google Tag Manager,Drupal,HSTS,Cloudflare,Pantheon,PHP,Fastly,MariaDB,Nginx]
203
+ https://gslink.hackerone.com [404 Not Found] [Nginx,Amazon CloudFront,Amazon Web Services]
204
+ https://mta-sts.hackerone.com [Page not found &middot; GitHub] [GitHub Pages,Fastly]
205
+ https://api.hackerone.com [HackerOne API] [Algolia,HSTS,Cloudflare]
206
+ http://resources.hackerone.com [Sorry, no Folders found.] [Amazon Web Services]
207
+ https://hackerone.com [HackerOne | #1 Trusted Securit] [Cloudflare,Drupal,Google Tag Manager,HSTS,Pantheon,PHP,Fastly,MariaDB,Nginx]
208
+ https://mta-sts.forwarding.hackerone.com [Page not found &middot; GitHub] [Fastly,GitHub Pages]
209
+ https://docs.hackerone.com [HackerOne Help Center] [Cloudflare,HSTS]
210
+ https://support.hackerone.com [Sign into : HackerOne Support ] [HSTS,Envoy,Cloudflare,HTTP/3]
211
+ [07:44:00][INF]: Completed with 23 subdomains for hackerone.com in 9 seconds 58 milliseconds
212
+ ```
213
+
214
+ **Pipe Domains from a File with IP Resolution and HTTP Status Codes:**
215
+ ```console
216
+ cat domains.txt | subcat -ip -sc
217
+ ```
218
+
219
+ **Run with Reverse Lookup Mode (Requires IP Scope):**
220
+ ```console
221
+ subcat -d example.com --scope 8.8.8.0/24 -r
222
+ ```
223
+
224
+ **Scan a Domain and Save the Output to a File (Verbose Mode):**
225
+ ```console
226
+ subcat -d hackerone.com -o output.txt -v
227
+ ```
228
+
229
+ **Integrate with HTTPx for Further Processing or any other tool:**
230
+ ```console
231
+ echo hackerone.com | subcat -silent -td -title | httpx -silent
232
+ ```
233
+
234
+ **Scan Multiple Domains from a List:**
235
+ ```console
236
+ subcat -l domains.txt
237
+ ```
238
+
239
+ **Custom Module Selection:**
240
+ ```console
241
+ subcat -d example.com -s dnsdumpster,virustotal,urlscan -es digitalyama,anubis
242
+ ```
243
+
244
+
245
+ ## Available Modules
246
+
247
+ SubCat currently supports the following modules for passive subdomain discovery:
248
+
249
+ - dnsdumpster
250
+ - digitalyama
251
+ - virustotal
252
+ - binaryedge
253
+ - chaos
254
+ - bevigil
255
+ - dnsarchive
256
+ - netlas
257
+ - wayback
258
+ - shodan
259
+ - securitytrails
260
+ - urlscan
261
+ - ctrsh
262
+ - threatcrowd
263
+ - anubis
264
+ - censys
265
+ - alienvault
266
+ - hackertarget
267
+ - certspotter
268
+
269
+ SubCat's modular architecture is designed for flexibility and ease of extension.
270
+
271
+ If you have an idea for a new module or want to contribute improvements, feel free to submit a pull request. Your contributions help make SubCat even better!
272
+
273
+
274
+ ### License
275
+
276
+ SubCat is made with 🖤 by duty1g
277
+
278
+ <a href="https://www.buymeacoffee.com/duty1g" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
subcat-1.3.1/README.md ADDED
@@ -0,0 +1,262 @@
1
+
2
+ # SubCat v1.3.0
3
+
4
+ ![alt text](https://img.shields.io/github/stars/duty1g/subcat "")
5
+ ![alt text](https://img.shields.io/github/languages/top/duty1g/subcat "")
6
+ ![alt text](https://img.shields.io/github/license/duty1g/subcat "")
7
+ <a href="https://twitter.com/duty_1g"><img src="https://img.shields.io/twitter/follow/duty_1g.svg?logo=twitter"></a>
8
+
9
+
10
+ <p align="center"><img src="https://user-images.githubusercontent.com/3162883/168605639-8a2cb290-38d3-4edb-9587-584d17f4fac3.png#gh-dark-mode-only" width="60%"/>
11
+ <img src="https://user-images.githubusercontent.com/3162883/169028346-3151e07e-ea94-4911-8009-942a5f384c77.png#gh-light-mode-only" width="60%"/>
12
+ </p>
13
+ <h4 align="center">Fast subdomain enumeration tool.</h4>
14
+
15
+ <p align="center">
16
+ <a href="#features">Features</a> •
17
+ <a href="#Install">Install</a> •
18
+ <a href="#post-installation">Post Installation</a> •
19
+ <a href="#Usage">Usage</a> •
20
+ <a href="#running-subcat">Running SubCat</a>
21
+ <a href="#available-modules">Available Modules</a>
22
+ </p>
23
+
24
+ #
25
+ SubCat is a powerful subdomain discovery tool that passively aggregates data from a variety of online sources to identify valid subdomains for websites. Designed with a modular and efficient architecture, SubCat is ideal for penetration testers, bug bounty hunters, and security researchers.
26
+
27
+ Built to comply with licensing and usage restrictions of its passive sources, SubCat ensures minimal impact on target systems while delivering in-depth subdomain intelligence.
28
+
29
+
30
+ ## Features
31
+
32
+ <img width="1000" alt="demo" src="https://github.com/user-attachments/assets/1de8c659-f35b-44ce-9aa8-c0437717591b">
33
+
34
+ - **Fast Enumeration:** Leverages a high-performance resolution and wildcard elimination module.
35
+ - **Curated Passive Sources:** Gathers subdomains from trusted online sources to maximize coverage.
36
+ - **Lightweight & Efficient:** Optimized for speed with minimal resource consumption.
37
+ - **STDIN/STDOUT Integration:** Seamlessly integrate with other tools and workflows.
38
+ - **IP Scope Filtering:** Filter results by IP addresses using a provided scope (CIDR or file-based).
39
+ - **Detailed Output:** Options to display HTTP status codes, page titles, IP addresses, and technology detection.
40
+ - **Reverse Lookup Mode:** Supports reverse lookup to load only modules that handle reverse enumeration (requires a valid IP scope).
41
+ - **Custom Module Selection:** Include or exclude specific modules via command-line flags.
42
+ - **Enhanced Multi-threading:** Uses 50 concurrent threads by default for rapid processing.
43
+
44
+
45
+ ## Install
46
+ ```
47
+ # Linux, Windows, MacOS
48
+ pip install subcat
49
+ ```
50
+
51
+ ## Post Installation
52
+
53
+ Before querying third-party services, configure your API keys in the `config.yaml` file.
54
+
55
+ By default, SubCat looks for the configuration file in your user's home directory under `~/.subcat/config.yaml`. You can also specify a custom config path using the `-c` or `--config` option.
56
+
57
+ > Not all modules require an API key, but the following sources do:
58
+
59
+ - **BinaryEdge**
60
+ - **Virustotal**
61
+ - **SecurityTrails**
62
+ - **Shodan**
63
+ - **Bevigil**
64
+ - **Chaos**
65
+ - **DNSDumpster**
66
+ - **Netlas**
67
+ - **DigitalYama**
68
+ - **Censys**
69
+ - **AlienVault**
70
+ - **CertSpotter**
71
+ - **URLScan** (for advanced usage)
72
+
73
+
74
+ An example provider config file
75
+
76
+ ```yaml
77
+
78
+ binaryedge:
79
+ - e3a2f1c4-9d2b-47f3-a1e2-4b8d7f0a1c2e
80
+ virustotal:
81
+ - b1e2d3c4f5a6978877665544332211ffeeddccbbaa99887766554433221100ff
82
+ securitytrails:
83
+ - X7a9B2c4D6e8F0g1H3i5J7k9L1m3N5o7
84
+ - P8q6R4s2T0u8V6w4X2y0Z8a6B4c2D0e2
85
+ shodan:
86
+ - M3n4O5p6Q7r8S9t0U1v2W3x4Y5z6A7b8
87
+ bevigil:
88
+ - F1g2H3i4J5k6L7m8
89
+ chaos:
90
+ - d2c4b6a8-90ef-12ab-34cd-56ef78ab90cd
91
+ dnsdumpster:
92
+ - c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4
93
+ - e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5
94
+ netlas:
95
+ - Z1x2C3v4B5n6M7a8S9d0F1g2H3j4K5l6
96
+ digitalyama:
97
+ - Q1w2E3r4T5y6U7i8O9p0
98
+
99
+
100
+ ```
101
+
102
+ ## Usage
103
+
104
+ ```console
105
+ subcat -h
106
+ ```
107
+ This will display help for the tool. Here are all the switches it supports.
108
+
109
+ ```yaml
110
+ INPUT:
111
+ -d DOMAIN, --domain DOMAIN
112
+ Target domain to scan
113
+ -l LIST, --list LIST File containing list of domains
114
+ --scope SCOPE IP scope filter: provide either a file containing CIDR ranges or a single IP/CIDR string (e.g., '8.8.8.8' or
115
+ '8.8.4.0/24'). This filter is required when reverse lookup is enabled.
116
+
117
+ OUTPUT:
118
+ -o OUTPUT, --output OUTPUT
119
+ Output file
120
+ -title, --title Show page titles
121
+ -ip, --ip Resolve IP addresses
122
+ -sc, --status-code Show HTTP status codes
123
+ --up Show only domains that are up (exclude TIMEOUT)
124
+ -td, --tech Show detected technologies
125
+ -nc, --no-colors Disable colored output in console
126
+
127
+ FILTERS:
128
+ -mc MATCH_CODES, --match-codes MATCH_CODES
129
+ Comma separated list of HTTP status codes to filter (e.g., 200,404)
130
+
131
+ SOURCE:
132
+ -ls List available modules and exit
133
+ -s SOURCES, --sources SOURCES
134
+ Specific sources to use for discovery (comma-separated, e.g., crtsh,wayback)
135
+ -es EXCLUDE_SOURCES, --exclude-sources EXCLUDE_SOURCES
136
+ Sources to exclude from enumeration (comma-separated, e.g., alienvault,crtsh)
137
+ -r, --reverse Enable reverse lookup mode for enumeration (loads only modules supporting reverse lookup). Requires --scope
138
+ to be provided.
139
+
140
+ CONFIGURATION:
141
+ -t THREADS, --threads THREADS
142
+ Number of concurrent threads (default: 50)
143
+ -c CONFIG, --config CONFIG
144
+ Path to YAML config file (default: config.yaml)
145
+
146
+ DEBUG:
147
+ -v, --verbose Increase verbosity level (-v, -vv, -vvv)
148
+ -silent, --silent Suppress all output except results
149
+ -h, --help Show this help message and exit
150
+ ```
151
+
152
+ ## Running SubCat
153
+ Here are several examples to help you get started:
154
+
155
+ **Scan a Single Domain:**
156
+ ```console
157
+ subcat -d hackerone.com --sc --title --tech --up
158
+
159
+
160
+ ; ;
161
+ ρββΚ ;ββΝ
162
+ έΆχββββββββββββββββββΒ
163
+ ;ΣΆχΜ΅΅ΫΝββββββββ Ϋ΅ΫβββΝ
164
+ όΆΆχβ Ά ββββ΅ Ά΅ βββββ
165
+ χΆΆΆφβΒ; Ϋ΅;έββββΒ; Ϋ΅ ρββββββ
166
+ ΆΆΆΆδβββββββββ;χββββββμβββββββ
167
+ ΪχχχχΧβββββββββββββββββββθθθθΚ
168
+ ·ϊβθβζ Ϊθθβββββββββββββββμ ;όβΫ΅
169
+ ·΅ ΅ΫΫΫΆΆθβββββββββθθΫ΅ ΅Ϋ΅
170
+ ;ΣΆθββββΒΝρρρμ
171
+ ;ΣΆΆβββββββββββμ
172
+ ▄∞∞∞∞∞▄, ╒∞∞▄ ∞∞▄ ▄∞∞∞∞∞∞▄ ,▄∞∞∞∞▄ ▄∞∞4▄ ╒∞∞∞∞∞∞∞▄,
173
+ ▐▄ ═▄▄▄ ▐█▐ ,▀ j' █▌█ ▄▄▄ ▀█▌█▀ ╓▄▄ ▀▄ ¡█ , ▐█ ▐▄▄▄ ▄▄██
174
+ ▐▄ `'""▀██▐ █▌ j █▌█ `"" ▄█▌█ ▐█▀`▀▄██' M $██ █, `█ ▐█```
175
+ j▀▀███▌ ▐█▐ ▀▌▄█ ▀▀█ ▐███ █▌▄ ▀█▄▄▀ ▐█M▀. ▀█▄.▀ J▀
176
+ ╚▄,,¬¬⌐▄█▌ ▀▄,,, ▄██ █,,,,,▓██▌ ▀▄,,,,▄█╩j▌,██▀▀▀▀▌,█▌`█,▐█
177
+ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ""▀▀▀▀▀▀ ▀▀▀""` ▀▀▀ ▀▀▀ ▀▀▀
178
+ ΅qΆΆΆΆβββββββββββββββββββββΡ΅
179
+ ΫθΆΆΆββββββββββββββββΡ΅
180
+ ΅ΫΫΫ΅ΝNNΝΫΫΫΐ΅Ϋ
181
+ v{1.3.0#dev}@duty1g
182
+
183
+ [07:43:51][INF]: Starting enumeration for hackerone.com
184
+ [07:43:51][INF]: Loaded 19 modules
185
+ https://mta-sts.managed.hackerone.com [Page not found &middot; GitHub] [Fastly,GitHub Pages]
186
+ https://www.hackerone.com [HackerOne | #1 Trusted Securit] [Google Tag Manager,Drupal,HSTS,Cloudflare,Pantheon,PHP,Fastly,MariaDB,Nginx]
187
+ https://gslink.hackerone.com [404 Not Found] [Nginx,Amazon CloudFront,Amazon Web Services]
188
+ https://mta-sts.hackerone.com [Page not found &middot; GitHub] [GitHub Pages,Fastly]
189
+ https://api.hackerone.com [HackerOne API] [Algolia,HSTS,Cloudflare]
190
+ http://resources.hackerone.com [Sorry, no Folders found.] [Amazon Web Services]
191
+ https://hackerone.com [HackerOne | #1 Trusted Securit] [Cloudflare,Drupal,Google Tag Manager,HSTS,Pantheon,PHP,Fastly,MariaDB,Nginx]
192
+ https://mta-sts.forwarding.hackerone.com [Page not found &middot; GitHub] [Fastly,GitHub Pages]
193
+ https://docs.hackerone.com [HackerOne Help Center] [Cloudflare,HSTS]
194
+ https://support.hackerone.com [Sign into : HackerOne Support ] [HSTS,Envoy,Cloudflare,HTTP/3]
195
+ [07:44:00][INF]: Completed with 23 subdomains for hackerone.com in 9 seconds 58 milliseconds
196
+ ```
197
+
198
+ **Pipe Domains from a File with IP Resolution and HTTP Status Codes:**
199
+ ```console
200
+ cat domains.txt | subcat -ip -sc
201
+ ```
202
+
203
+ **Run with Reverse Lookup Mode (Requires IP Scope):**
204
+ ```console
205
+ subcat -d example.com --scope 8.8.8.0/24 -r
206
+ ```
207
+
208
+ **Scan a Domain and Save the Output to a File (Verbose Mode):**
209
+ ```console
210
+ subcat -d hackerone.com -o output.txt -v
211
+ ```
212
+
213
+ **Integrate with HTTPx for Further Processing or any other tool:**
214
+ ```console
215
+ echo hackerone.com | subcat -silent -td -title | httpx -silent
216
+ ```
217
+
218
+ **Scan Multiple Domains from a List:**
219
+ ```console
220
+ subcat -l domains.txt
221
+ ```
222
+
223
+ **Custom Module Selection:**
224
+ ```console
225
+ subcat -d example.com -s dnsdumpster,virustotal,urlscan -es digitalyama,anubis
226
+ ```
227
+
228
+
229
+ ## Available Modules
230
+
231
+ SubCat currently supports the following modules for passive subdomain discovery:
232
+
233
+ - dnsdumpster
234
+ - digitalyama
235
+ - virustotal
236
+ - binaryedge
237
+ - chaos
238
+ - bevigil
239
+ - dnsarchive
240
+ - netlas
241
+ - wayback
242
+ - shodan
243
+ - securitytrails
244
+ - urlscan
245
+ - ctrsh
246
+ - threatcrowd
247
+ - anubis
248
+ - censys
249
+ - alienvault
250
+ - hackertarget
251
+ - certspotter
252
+
253
+ SubCat's modular architecture is designed for flexibility and ease of extension.
254
+
255
+ If you have an idea for a new module or want to contribute improvements, feel free to submit a pull request. Your contributions help make SubCat even better!
256
+
257
+
258
+ ### License
259
+
260
+ SubCat is made with 🖤 by duty1g
261
+
262
+ <a href="https://www.buymeacoffee.com/duty1g" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
@@ -0,0 +1,3 @@
1
+ [build-system]
2
+ requires = ["setuptools>=61.0", "wheel"]
3
+ build-backend = "setuptools.build_meta"
subcat-1.3.1/setup.cfg ADDED
@@ -0,0 +1,36 @@
1
+ [metadata]
2
+ name = subcat
3
+ version = 1.3.1
4
+ description = Lightning-fast passive subdomain discovery tool for security professionals and bug bounty hunters.
5
+ long_description = file: README.md
6
+ long_description_content_type = text/markdown
7
+ author = duty1g
8
+ author_email = sec@dzauth.com
9
+ url = https://github.com/duty1g/subcat
10
+ license = MIT
11
+ classifiers =
12
+ Programming Language :: Python :: 3
13
+ License :: OSI Approved :: MIT License
14
+ Operating System :: OS Independent
15
+
16
+ [options]
17
+ packages = find:
18
+ python_requires = >=3.6
19
+ install_requires =
20
+ requests>=2.25.0
21
+ PyYAML>=5.4.0
22
+ include_package_data = True
23
+
24
+ [options.package_data]
25
+ subcat =
26
+ fingerprints.json
27
+ modules/*.py
28
+
29
+ [options.entry_points]
30
+ console_scripts =
31
+ subcat = subcat.subcat:main
32
+
33
+ [egg_info]
34
+ tag_build =
35
+ tag_date = 0
36
+
subcat-1.3.1/setup.py ADDED
@@ -0,0 +1,2 @@
1
+ from setuptools import setup
2
+ setup()
@@ -0,0 +1,5 @@
1
+ from .subcat import SubCat
2
+ from .detector import Detector
3
+ from .logger import Logger
4
+ from .navigator import Navigator
5
+ from .config import Config
@@ -0,0 +1,36 @@
1
+ import yaml
2
+ import os
3
+
4
+
5
+ class Config:
6
+ def __init__(self, logger=None, config: str = 'config.yaml'):
7
+ self.logger = logger
8
+ # Check if config is an absolute path; if not, use current file's directory.
9
+ if not os.path.isabs(config):
10
+ dir_path = os.path.dirname(os.path.realpath(__file__))
11
+ self.config = os.path.join(dir_path, config)
12
+ else:
13
+ self.config = config
14
+
15
+ # Check if the file exists
16
+ if not os.path.exists(self.config):
17
+ if self.logger:
18
+ self.logger.error(f"Config file not found: {self.config}")
19
+ else:
20
+ print(f"Config file not found: {self.config}")
21
+ self.config = None
22
+
23
+ def read(self, module: str):
24
+ if not self.config:
25
+ return False
26
+ try:
27
+ with open(self.config, 'r') as f:
28
+ data = yaml.safe_load(f)
29
+ # Return the module data if present, else False
30
+ return data.get(module, False)
31
+ except Exception as e:
32
+ if self.logger:
33
+ self.logger.error(f"Failed to read config file: {e}")
34
+ else:
35
+ print(f"Failed to read config file: {e}")
36
+ return False