Home

Awesome

domained [archived]

A domain name enumeration tool

This project is no longer maintained.

Thank you to @ccsplit and @mzfr for their work on domained.

Gist: Some terrible continually updated python code leveraging some awesome tools that I use for bug bounty reconnaissance.

The tools contained in domained requires Kali Linux (preferred) or Debian 7+ and Recon-ng

domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output)

Initial Install:
Other Dependencies:

NOTE: This is an active recon – only perform on applications that you have permission to test against.

Tools leveraged:
Subdomain Enumeraton Tools:
  1. Sublist3r by Ahmed Aboul-Ela
  2. enumall by Jason Haddix
  3. Knock by Gianni Amato
  4. Subbrute by TheRook
  5. massdns by B. Blechschmidt
  6. Recon-ng by Tim Tomes (LaNMaSteR53)
  7. Amass by Jeff Foley (caffix)
  8. SubFinder by by Ice3man543
Reporting + Wordlists:
Usage
First Step:
Install Required Python Modules: sudo pip install -r ./ext/requirements.txt
Install Tools: sudo python3 domained.py --install

Example 1: python3 domained.py -d example.com
Uses subdomain example.com (Sublist3r (+subbrute), enumall, Knock, Amass, and SubFinder)

Example 2: python3 domained.py -d example.com -b -p --vpn
Uses subdomain example.com with seclist subdomain list bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall, and SubFinder), adds ports 8443/8080 and checks if on VPN

Example 3: python3 domained.py -d example.com -b --bruteall
Uses subdomain example.com with large-all.txt bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall and SubFinder)

Example 4: python3 domained.py -d example.com --quick
Uses subdomain example.com and only Amass and SubFinder

Example 5: python3 domained.py -d example.com --quick --notify
Uses subdomain example.com, only Amass and SubFinder and notification

Example 6: python3 domained.py -d example.com --noeyewitness
Uses subdomain example.com with no EyeWitness

Note: --bruteall must be used with the -b flag
OptionDescription
--install/--upgradeBoth do the same function – install all prerequisite tools
--vpnCheck if you are on VPN (update with your provider)
--quickUse ONLY Amass and SubFinder
--bruteallBruteforce with JHaddix All.txt List instead of SecList
--freshDelete old data from output folder
--notifySend Pushover or Gmail Notifications
--activeEyeWitness Active Scan
--noeyewitnessNo Eyewitness
-dThe domain you want to preform recon on
-bBruteforce with subbrute/massdns and SecList wordlist
-s nOnly HTTPs domains
-pAdd port 8080 for HTTP and 8443 for HTTPS
Notifications
To-Do List
Thank You to Contributors
Major Updates